topic Re: Traffic Logs - Multiple IP's in General Topics

Traffic Logs - Multiple IP's

James.Christian — Fri, 19 May 2017 14:58:58 GMT

Hi,

Is there an easy way to monitor traffic logs on say 20 IP's to see if any IOC's are being hit? I'm guessing I could build a filter for each IP but I was hoping there might be a way to do it easier. These are not contiguous IP's so CIDR won't help me.

Thanks,

James

Re: Traffic Logs - Multiple IP's

Raido_Rattameister — Fri, 19 May 2017 15:17:43 GMT

Why just not use ( addr.src in 10.0.0.0/8 ) assuming you use 10. in your lan.

Or build more complex filter.

Below one will show if any of those IPs have web-browsing on some other port than 80 or ssl not on 443.

(( addr.src in 1.1.1.1 ) or ( addr.src in 2.2.2.2 ) or ( addr.src in 3.3.3.3 )) and ((( app eq web-browsing ) and ( port.dst neq 80 )) or (( app eq ssl ) and ( port.dst neq 443 )))

Re: Traffic Logs - Multiple IP's

Remo — Fri, 19 May 2017 16:45:16 GMT

What about creating a new rule where you attach your IOC IP's? To make the management of these IP's even easier you could use an EDL (text file which palo will fetch from a webservet). This way you can simply edit the textfile when you have new IP's or when you want to delete old ones and the fw will get the updated list into the running config without a commit.
In the monitor tab you will then filter on this new rules name or you could also attach a custom logforwarding profile to forward hits to this rule via email/syslog/snmp-trap/http