topic Re: Threat log original destination required in vm firewall deployed in aws in General Topics

Threat log original destination required in vm firewall deployed in aws ..

omprasadax — Tue, 23 Jun 2020 09:30:28 GMT

Hi Team,

We have VM firewall deployed at AWS.

>> Paloalto>>ALB>> servers

Now in threat log we are getting logs for destination as ALB because of this architecture.

Is it possible to get logs for actual destination server in threat log by any means ?

Thanking you in advance!!

Re: Threat log original destination required in vm firewall deployed in aws

DelvinC — Wed, 24 Jun 2020 03:12:40 GMT

I don' think you can get logs for actual destination server in the threat logs on the virtual firewall. The virtual firewall's visibility does not go beyond the ALB based on the setup that you have. In the give scenario, you'll need to correlate the timestamps on the virtual firewall and the ALB logs to identify the original destination server.

Another alternative is if you are using Cortex-XDR.

Re: Threat log original destination required in vm firewall deployed in aws

omprasadax — Thu, 25 Jun 2020 04:09:35 GMT

If SSL inbound inspection configured in this case then will it be meaningful?

Re: Threat log original destination required in vm firewall deployed in aws

DelvinC — Fri, 26 Jun 2020 21:05:30 GMT

If we were to look at this problem from a different perspective, what are we trying to achieve by looking at the threat logs? Are you just looking to block the threats or identify the impacted server?

Re: Threat log original destination required in vm firewall deployed in aws

omprasadax — Sat, 27 Jun 2020 04:56:35 GMT

Yes, we want to identify impacted server then if required we would take any other action

Re: Threat log original destination required in vm firewall deployed in aws

BPry — Sun, 28 Jun 2020 03:30:19 GMT

@omprasadax,

You won't be able to get the destination of the actual server if this is being fed through the ALB; as @DelvinC initially mentioned, the firewalls visibility into the traffic stops once the packet reaches the ALB. You will need to have some sort of SIEM (Like Cortex, Splunk, Graylog, ect) to aggregate these logs if you don't want to manually corelate them.