Expedition ML rules with any/any

L1 Bithead

Expedition ML rules with any/any

After a week of logs from a NGFW I tryed to ML rules from it and got a couple of "suspicious" rules, for example these two below:Capture.PNG


 In these, as you can see, the source, destination and service are any. What is the threshold that makes Expedition consider an any on the src.ip ou dst.ip? Is there a way to get the full list of destinations?


Thank you.

L7 Applicator

Re: Expedition ML rules with any/any

Hi Bruno, Common Apps are taken in that way, apps like ping, dns that generates tons of logs are considered by ML as a single rule allowed from any to any. If you want to know the sources and destinations then you can apply Rule Enrichment. We do that because those apps can represent the 60% of the total traffic and at the time to analyze you can exclude them if you want meaning we will only consider the 40% of the traffic just for the analisys.


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!