topic Re: Scanning network flow using file name in General Topics

Scanning network flow using file name

Interface — Mon, 19 Aug 2013 13:52:48 GMT

Hello,

Any know an opportunity to scan network flow with PaloAlto to find files by file name? Eg.: i entered "angry tiger" and i find all files (including all file types) with that name sent over the network.

Re: Scanning network flow using file name

kprakash — Mon, 19 Aug 2013 14:31:58 GMT

Please check these links:

https://live.paloaltonetworks.com/docs/DOC-3904

https://live.paloaltonetworks.com/message/23749#23749

https://live.paloaltonetworks.com/message/10273#10273

https://live.paloaltonetworks.com/message/11919#11919

BR,

Karthik RP

Re: Scanning network flow using file name

Phoenix — Mon, 19 Aug 2013 14:33:41 GMT

Hello,

We see that you are looking for certain text and you are receiving all files with all file types. If there is a filter to be made for certain file types we will have to use the file blocking profile as explained below.

https://live.paloaltonetworks.com/docs/DOC-3094

You can also create custom vulnerability by creating custom signature for matching a certain pattern of text in files so that the PAN can search for these texts and when matches logs with the custom vulnerability on the device.

Thanks

Re: Scanning network flow using file name

Interface — Tue, 20 Aug 2013 07:12:07 GMT

Thanks for answers. So as i understand, no way to find file using file name. Or anyone has other ideas?

Let me explain more what i want: If someone sent a file: angry_tiger.doc or angry_tiger.mp3, or angry_tiger.avi, or angry_tiger.*(any file type). Can i some how find that file using file name "angry_tiger"?

Re: Scanning network flow using file name

HULK — Tue, 20 Aug 2013 07:38:24 GMT

Please follow below mentioned discussion for more info:

https://live.paloaltonetworks.com/message/3553#3553

Hope it helps.

Thanks

Re: Scanning network flow using file name

VinceM — Tue, 20 Aug 2013 08:37:16 GMT

Hi,

If you want to search file name, you ave to go through data filtering profile.

The easiest way to do it is to use regex? With this method you can search all what you want.

Eg: https://live.paloaltonetworks.com/docs/DOC-4860.

Just keep in mind that you can't search string with size under 7.

Hope help.

Re: Scanning network flow using file name

Interface — Tue, 20 Aug 2013 10:22:14 GMT

I found one solution: i must log all file types using File Blocking profile (File Type -> any, Action -> alert) and then in a Data Filtering log i can find file using file name. Not ideal, but works

Re: Scanning network flow using file name

VinceM — Tue, 20 Aug 2013 10:31:12 GMT

Hi,

yes you can do that, very usefull for auditing 🙂

Maybe upload logs to syslog server and make a script for sending an alert