topic Re: Suspicious login attempt found on PA. in General Topics

Suspicious login attempt found on PA.

imranshahid — Tue, 08 Aug 2017 11:11:17 GMT

Hi All,

I have a situation where someone tried to access Palo Alto and failed to login as the authentication was not granted. Any idea where i can go and see what was the source IP and location etc. A bit of forensics.

Any suggestions most welcome.

Imran

(Brighton)

Re: Suspicious login attempt found on PA.

Mick_Ball — Tue, 08 Aug 2017 11:30:34 GMT

PA-3020 shows failed auths in /Monitor/System.

Event = auth-fail

this shows the ip address of the failed auth.

Re: Suspicious login attempt found on PA.

Mick_Ball — Tue, 08 Aug 2017 11:31:51 GMT

this shows the source ip address of the failed auth.

Re: Suspicious login attempt found on PA.

Remo — Tue, 08 Aug 2017 11:35:48 GMT

Except for console logins, there obviously is no IP address

Re: Suspicious login attempt found on PA.

imranshahid — Wed, 16 Aug 2017 09:51:08 GMT

so how would you find the source IP ? Any comments please feel free

Re: Suspicious login attempt found on PA.

TranceforLife — Wed, 16 Aug 2017 12:17:58 GMT

Hi,

It says from:

You can only see this info if the attempts were initiated to the mgmt interface. If the user was trying to get access over the data-plane interface, then check intra-zone traffic (if logging is enabled) filtering based on the destination Palo ip address as well as destination port 443.

Re: Suspicious login attempt found on PA.

reaper — Wed, 16 Aug 2017 13:32:44 GMT

you will also get auth-fail logs if the attempt was made on a dataplane management profile 🙂

Re: Suspicious login attempt found on PA.

TranceforLife — Wed, 16 Aug 2017 13:36:51 GMT

Nice! I thought system log just includes mgmt interface attempts