topic send alerts when large files uploaded in General Topics

send alerts when large files uploaded

dvu5103 — Tue, 01 Jul 2014 22:53:09 GMT

Hi all,

Please help to config in PAN devices a rule to send alerts to admin when large files, say geq 100Mb, are uploaded to Internet.

Thank you.

Re: send alerts when large files uploaded

hshah — Tue, 01 Jul 2014 23:01:21 GMT

Hello DVU,

If file has any threat content than firewall generates alert.

It doesnt generate any log for larger file, Its not possible as of now.

Regards,

Hardik Shah

Re: send alerts when large files uploaded

HULK — Tue, 01 Jul 2014 23:04:37 GMT

Hello Dvu5103,

You can create a custom signature for the same:

For an example:

----Go to Object > Custom Objects > Vulnerability and click Add ( Set default action to "alert")

----Go to the Custom Vulnerability Signature > Signatures tab and click Add

----In the window that appears, create a custom signature with 'And condition'.

---In the Standard window, click 'Add Or Condition' and set 'Operator to Greater Than'

---Set an appropriate context.

----You can add this profile in a security profile.

You can post a request to our development team ( Dev-Center), they will be able to help you for the same, else contact with your Palo Alto Networks SE, he will guide you.

Thanks.

Re: send alerts when large files uploaded

dvu5103 — Tue, 01 Jul 2014 23:04:48 GMT

In order to protect our information, we need to monitor all upload activities to Internet. So it's not possible in PANs ?

Thank you.

Re: send alerts when large files uploaded

dvu5103 — Tue, 01 Jul 2014 23:09:57 GMT

Thanks, Hulk. I will study your guidance.

Re: send alerts when large files uploaded

hshah — Tue, 01 Jul 2014 23:36:43 GMT

Hello DVU5103,

It would be hard to specify file size as a parameter in vulnerability custom signature. Hence as HULK said it would be good idea to contact SE.

Regards,

Hardik Shah

Re: send alerts when large files uploaded

mivaldi — Tue, 01 Jul 2014 23:53:33 GMT

You can not do alerts, but you can have a daily report for sessions with large data transfers. You will get the information you need the next day.

Go to Monitor > Manage Custom Reports

Add a custom report selecting Database=Traffic Log, Time Frame=Last 24 hours, sort by Bytes, add a query statement with the query builder to have Attribute Bytes, Operator greater or equal than, and add the value.

Then set up your Email Scheduler to have the report be delivered Daily. These will generate every day at 2:02am.

Re: send alerts when large files uploaded

hshah — Wed, 02 Jul 2014 00:10:30 GMT

Hi Mivaldi,

This appears to be a faster workaround.

Regards,

Hardik Shah

Re: send alerts when large files uploaded

HULK — Wed, 02 Jul 2014 00:13:00 GMT

Lets try with these available contexts:

This doc will give you some guideline too: Custom Application Signatures

Thanks