topic Threat log forwarding from unlicensed PA device? in General Topics

Threat log forwarding from unlicensed PA device?

OMatlock — Thu, 20 Jun 2019 21:12:52 GMT

Hi folks,

I believe I know the answer, but wanting to make sure I understand. I am configuring log forwarding to a Varonis server for testing. I've been sending the traffic log, but Varonis will only process the Threat log.

I've configured the Threat in the Log forwarding profile, Vulnerability profie, etc and assigned it to my security rule, but my threat log is empty in general. I assuming this is because my device is unlicensed? Pa200 7.1.15. I guess I was hoping that something (anything) would go through.

Just checking if there are comments before I give up for now. 🙂

Re: Threat log forwarding from unlicensed PA device?

S.Cantwell — Thu, 20 Jun 2019 21:17:16 GMT

Agreed that without a license, you will not get the AV/Spyware/Vuln signature to match.

You could test with enabling Zone Protection Profile and DoS Protection Policies and force an attempted ping flood attack or port scan, or whatever... something that would "hit" as a threat in the logs, but does not require a licensed feature from PANW.

Thanks

Re: Threat log forwarding from unlicensed PA device?

MP18 — Fri, 21 Jun 2019 04:54:39 GMT

I think you can forward the threat logs without having the threat license.

Re: Threat log forwarding from unlicensed PA device?

RobinClayton — Fri, 21 Jun 2019 07:32:09 GMT

Without a licence there are no threats to forward.