Threat Activity (ACC) and Monitor-LOGS-threats are empty

Ots-network — Fri, 06 Aug 2021 09:59:04 GMT

As the title suggest i have on my fw (pan os 10.0.4) Threat Activity (ACC) and Monitor-LOGS-threats totally empty.
Since few weeks ago no problem and all the other logs work fine.

And no changes have been made.
Any ideas?

already restart mgmt service withuot success.

Re: Threat Activity (ACC) and Monitor-LOGS-threats are empty

BPry — Fri, 06 Aug 2021 15:51:18 GMT

@Ots-network,

Have you tried actually restarting the firewall and not just the mgmt server? Are you actually sure that no changes have been made and someone maybe didn't accidentally remove the security group/profile from your policies?

The first thing I would do is verify through my traffic logs that traffic is hitting rules that actually have a security group/profiles assigned to it so that threat logs would actually be generated. Then I would just generate something stupid that I know should be getting logged as a threat, such as a directory traversal attempt or a simple unauthorized brute force attach on a login page.

topic Re: Threat Activity (ACC) and Monitor-LOGS-threats are empty in General Topics

Threat Activity (ACC) and Monitor-LOGS-threats are empty

Re: Threat Activity (ACC) and Monitor-LOGS-threats are empty