topic URL Logging - Best Practises? in General Topics

URL Logging - Best Practises?

networkadmin — Sun, 25 Jan 2015 16:00:29 GMT

What's the recommendation on the best way to configure a Palo Alto to log URLs visited during regular browsing?

We have various categories set to block which are of course logged but I've never quite got my head around the logic of setting something to "alert" when actually I don't want to see it in the URL logs, but I do want it logged - if that makes sense i.e. the URL logs should IMO just be a place to quickly see traffic that is the exception.

Re: URL Logging - Best Practises?

hshah — Sun, 25 Jan 2015 17:26:22 GMT

Hello Network Admin,

If you really want to monitor each and every users activity than I would suggest to go with alert of all categories. However, it has a tradeoff. If there is too much logging for URL logs than they will start overwriting older logs. You may not have logs for long period of time. If there is a panorama in the network than you wouldnt have to worry about this.

If you do not want to monitor browsing activity than just put certain category in "alert" mode like "arms" , "pornography" ,etc. Do not log URLs for social networking or search engines. Which logs only malicious activities only. That way you will have balanced logging which will help to retain logs for longer duration.

Let me know for additional queries.

Regards

Hardik Shah

Re: URL Logging - Best Practises?

jkim2 — Mon, 26 Jan 2015 21:05:23 GMT

answers is depends.

from a security standpoint i would recommend alert for all so you can correlate your traffic.

Without URL logging you may only be able to get the DNS which doesnt' always resolve back correctly if its hosted .

URL logging of all http/https traffic also helps with custom app-id creation and ips signature creation.

As far as not logging social networking i would also advise against that as C2 / Command and Control traffic can go through social media . If your doing SSL decrypt on the box or in the network url category search engines can also reveal alot of info.

Also by logging all traffic we've also identified non standard http traffic and the specfic URI

From a performance standpoint obviously not recommended to log everything.

Re: URL Logging - Best Practises?

oklier — Tue, 27 Jan 2015 00:36:17 GMT

I personally log everything so i have a record. Then just off load it to our log manager for archive. Just my 2 cents...