topic Re: Traffic vs Threat Logs in General Topics

Traffic vs Threat Logs

RonaldRichter — Thu, 07 Mar 2019 14:28:40 GMT

I am searching for the reasons behind the relatively large disparity between traffic logs and threat logs for specified traffic searches in splunk. Redirected sessions cant be a contributed factor when the firewall is set to "log container page only"

Re: Traffic vs Threat Logs

OtakarKlier — Fri, 08 Mar 2019 19:04:50 GMT

Hello,

The threat logs compliment the traffic logs and have some different fields. Hope that helps.

Regards,

Re: Traffic vs Threat Logs

BPry — Fri, 08 Mar 2019 21:38:18 GMT

@RonaldRichter,

What exactly are you asking here?

Traffic logs and Threat logs are completely independent of eachother as far as size goes. I might have a single traffic log due to long-running sessions that can generate dozens/hundreds of threats in its lifetime depending on severity.

Re: Traffic vs Threat Logs

RonaldRichter — Mon, 11 Mar 2019 13:30:31 GMT

Thanks for the reply. Actually I am seeing the exact opposite, many more traffic logs versus threat.