Multiple malicious scans from the same source address - can I block IP automatically

Reply
Highlighted
L3 Networker

Re: Multiple malicious scans from the same source address - can I block IP automatically

Hi vsys_remo,

 

I've cloned syslogMiner node in MineMeld, and added (rigth after our Splunk server) the MMeld server to the syslog profile, port UDP 13514.  It seems that the new node is not receiving any data.  Also attempted creating a separate syslog server profile.

 

I've been following instructions contained in this doc:

 

https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-the-syslog-Miner/ta-p/77262

 

 

Luca

Tags (3)
L7 Applicator

Re: Multiple malicious scans from the same source address - can I block IP automatically

Hi @LucaMarchiori

 

This now more and more belongs into the minemeld forum;)

 

You also configured the local firewall (iptables) to allow this traffic and if needed edited the rsyslog.conf file?

 

Sounds like something similar as in this topic: https://live.paloaltonetworks.com/t5/MineMeld-Discussions/MineMeld-need-help-importing-and-processin...

L3 Networker

Re: Multiple malicious scans from the same source address - can I block IP automatically

Hi vsys_remo,

 

I agree.  I'll post this in the MineMeld forum, if needed.  I'd like to thank you and BPry for your help thus far. 

 

 

Luca

 

edit: the port was already opened on the ubuntu server, but it's using port TCP 13514, not UDP 13514. :-)

TCP clearly shows in the doc I linked, I simply missed that.

 

L2 Linker

Re: Multiple malicious scans from the same source address - can I block IP automatically

@vsys_remo could you please explain how the following can be implemented: 

"In PAN-OS 8 you could tag attacking IPs based on specific filters (for example when a critical vulnerability was blocked or even one specific vulnerability). With this tag you are then able to create a dynamic addressgroup and use this group in your policy to drop connections from there completely. "

 

Thanks.

Ho

L2 Linker

Re: Multiple malicious scans from the same source address - can I block IP automatically

Anyone know how to tag attacking IPs based on specific filters (for example when a critical vulnerability was blocked or even one specific vulnerability). With this tag you are then able to create a dynamic addressgroup and use this group in your policy to drop connections from there completely. 

 

Thanks,

Ho

L7 Applicator

Re: Multiple malicious scans from the same source address - can I block IP automatically

Hi @ash83 

 

You need to start with a log forwarding profile, there you define a specific filter for the threatlogs (you either filter on the severity or on specific threat ID or something completely different). As action you then choose to tag the source or destination IP (depending on your filter) and assign a Tag to these IPs. After that you create a dynamic address group with the criteria the tag you created for that. From this point you can use the address group in your policy to block connections from or to these IPs.

 

Hope this helps.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!