topic Re: Correlated Events Action in General Topics

Correlated Events Action

ToniE — Thu, 14 Apr 2016 09:26:03 GMT

Hello,

How Palo Alto choose action for correlated events? For example we have several medium severity events with summary Host visited known malware URL. In some events action is alert and some events action is block-url.

Re: Correlated Events Action

rmonvon — Thu, 14 Apr 2016 18:56:34 GMT

Hi...I believe the action block-url is done by your URL filtering policy. The correlated events are indicators of potential compromised hosts on the network that generated activity matching the Correlation objects. The Correlation objects are defined and developed by the Palo Alto Networks Threat Research team.

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/monitoring/automated-correlation-engine-concepts#81670

Re: Correlated Events Action

ToniE — Fri, 15 Apr 2016 06:26:02 GMT

Hi,

oh yes that's the reason now i get it.

thanks a lot rmonvon!