topic Re: Custom report for phishing prevention in General Topics

Custom report for phishing prevention

DwightHobbs — Wed, 14 Feb 2018 17:21:17 GMT

Is there a way to generate a custom report of users/sites that have entered credentials? I checked under the URL database but don't see a Credential Detected column there that I could pull in. Anyone have a method of generating a report from the phishing prevention feature?

Re: Custom report for phishing prevention

OtakarKlier — Fri, 16 Feb 2018 16:24:23 GMT

Hello,

While we do not have a report for this, we rely on the URL filtering and the threat and wildfire updates to prevent access to these types of sites. Most will have an 'Unknown' categorization which we block. Also we have an email gateway that is pretty good at filtering these types of messages out so our users hardly see them.

Probably not the answer you wer ehoping for.

Regards,

Re: Custom report for phishing prevention

DwightHobbs — Mon, 19 Feb 2018 18:39:56 GMT

Thanks for the reply!

We're using the IP user mapping method so we have a decent amount of false positives throughout the day. I was looking for a report so I could determine a path to start warning/blocking users without impacting legitimate users significantly.

Re: Custom report for phishing prevention

OtakarKlier — Tue, 20 Feb 2018 17:10:06 GMT

Hello,

If you use the block-pages, you can customize those so when users get them they see its from your company and not freak out.

Would something like that work?

Re: Custom report for phishing prevention

djr — Wed, 06 May 2020 16:39:38 GMT

This is an old post I just found because I tried to do the same thing. Has anyone put his in as a Feature Request or anyone from PAN here to say whether it's coming?

Re: Custom report for phishing prevention

djr — Wed, 06 May 2020 16:52:35 GMT

I can answer my own question, I just tried again but using the detailed URL logs and you can filter based on "flags has credential detected" and it works fine, at least for what I need, there is even a standard report "Credential Post Detected" which may do what you need.