Data Filtering timers and inner workings

CMachado — Fri, 19 Feb 2021 19:10:09 GMT

Hello, Live Community!

I've been using Data Filtering profiles for a while now and they work really well, but it has come to my attention that I don't really know some of the inner workings of it, specially today when someone asked me about it, so...

Does DF work with timers? I mean, what's the time range for detecting a data pattern/regex/file property and for it to count towards the defined threshold? Is this configurable? If I set an alert threshold of 2 for a CC# and someone transfers one number now and then waits for a week until transferring another one, will the threshold be met?

To my understanding, DF counts any instance of the data pattern/regex/property towards meetings the threshold, but is this per IP/User identity? Is this configurable?

Looking forward to your replies. Many thanks!

Re: Data Filtering timers and inner workings

kiwi — Mon, 22 Feb 2021 15:05:59 GMT

Hi @CMachado ,

The Alert Threshold and Block Threshold fields specify how many instances of a data match, within a single session, that must be observed before the Palo Alto Networks device performs an alert or block action, respectively.

Source: HOW TO CONFIGURE A DATA FILTERING PROFILE TO ALERT BUT NOT BLOCK

Cheers !

-Kiwi.

topic Data Filtering timers and inner workings in General Topics

Data Filtering timers and inner workings

Re: Data Filtering timers and inner workings