topic Re: Firewall active sessions age in General Topics

Firewall active sessions age

PS007 — Fri, 24 Apr 2020 15:17:06 GMT

Does PAN OS has a feature to calculate session age for any active session ? In particular looking from SOC point of view if they want to monitor long time period active sessions used by attackers to compromise security.

I am not looking for session timeout or reasons for that, but a life span of active session running.

Re: Firewall active sessions age

OtakarKlier — Sat, 25 Apr 2020 17:28:42 GMT

Hello,

I hope I understand your question correctly. You can look at the Session browser to see active sessions. This should be the info you are looking for.

Regards,

Re: Firewall active sessions age

BPry — Sun, 26 Apr 2020 08:16:42 GMT

@PS007,

As @OtakarKlier said, this information is in the Session Browser in the GUI or the CLI. I would recommend writing a script that pulls the session table from the API and searches for any sessions that breach your SOCs criteria for investigation.

Re: Firewall active sessions age

PS007 — Wed, 29 Apr 2020 18:35:55 GMT

Thanks @BPry, @OtakarKlier

I am looking for end time of session, Traffic & session browser log gives the start time of connection but if the session is ended or end time is not determined. I think the reason is the session state table removes any inactive sessions with announcing. Is there a way I can get session end time as well ?

Re: Firewall active sessions age

OtakarKlier — Wed, 29 Apr 2020 18:38:03 GMT

Hello,

Set the policies to log at session end. It should do what you need.

Regards,

Re: Firewall active sessions age

PS007 — Wed, 29 Apr 2020 19:17:31 GMT

Log at session end in security policy helps in determining the final app-id as app goes through transformation, but not the session end time.

Re: Firewall active sessions age

OtakarKlier — Wed, 29 Apr 2020 19:20:20 GMT

Actually that is its purpose, logs when the session ends.