topic Re: Threat log in General Topics

Threat log

dmodi — Mon, 30 Dec 2019 21:18:56 GMT

Hello Team,

In the firewall, it is showing around 4000 threat logs of brute force threat and I am receiving 4000 mail in my mailbox.

Is there any way for specific threat I will receive only one email

Re: Threat log

MP18 — Mon, 30 Dec 2019 21:48:01 GMT

As per My experience you can config alerts with severity high or critical.

If any user try to access the same url or file or anyone try brute force attempt you will get email alerts.

There is no way as per my knowledge that for any severity Alert you can get only 1 Email alert.

Re: Threat log

OtakarKlier — Mon, 30 Dec 2019 23:06:01 GMT

Hello,

I would recommend sending the logs to your SIEM and set thresholds there. Also you can set the PAN to block these attempts for up to an hour. This is configured in you Anti-spyware policy as well as Zone Protection policy.

Regards,

Re: Threat log

dmodi — Mon, 30 Dec 2019 23:27:57 GMT

I want to replicate so please let me how I can configure email forwarding with trail email gateway. Let me know any website providing email gateway trial

Re: Threat log

MP18 — Tue, 31 Dec 2019 01:01:58 GMT

You can use any website like

yahoo.com

gmail.com

I am using my webmail. shaw.ca as long as you know the email gateway. for example for my email at shaw.ca the email gateway is

mail.shaw.ca

Try this with yahoo.com email address if you have ?

Re: Threat log

dmodi — Wed, 01 Jan 2020 18:00:49 GMT

Re: Threat log

MP18 — Wed, 01 Jan 2020 18:51:46 GMT

IT should work as long as email server is reachable and traffic is allowed from your Firewall.

This email alert will go via Management plane of the firewall.

Please check below link

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUiCAK

Re: Threat log

dmodi — Wed, 01 Jan 2020 20:08:19 GMT

Tried with yahoo gmail but still getting same issue.

Please let me know how i can configure local mail server then i want to use that email server as an gateway or http server will also work to check the behavior of log forwarding

Re: Threat log

MP18 — Thu, 02 Jan 2020 00:37:56 GMT

My Internet Provider it works as shown below

For Yahoo and Gmail I do not know their settings.

Re: Threat log

dmodi — Thu, 02 Jan 2020 18:19:07 GMT

I tried with yahoo and Gmail but not worked. I tried to create an account in mail.shaw.ca but they need some account number and info. Anyone, please provide mail.shaw.ca account for testing purpose or let me know any other free service provider to replicate the issue

Re: Threat log

MP18 — Thu, 02 Jan 2020 18:31:54 GMT

I also tested yesterday with yahoo account it does not work.

For testing purposes you can use my email info.

You need to have Internet connection with them in order to create an email account.