11-22-2018 07:03 AM
After a week of logs from a NGFW I tryed to ML rules from it and got a couple of "suspicious" rules, for example these two below:
In these, as you can see, the source, destination and service are any. What is the threshold that makes Expedition consider an any on the src.ip ou dst.ip? Is there a way to get the full list of destinations?
Thank you.
11-27-2018 08:14 AM
Hi Bruno, Common Apps are taken in that way, apps like ping, dns that generates tons of logs are considered by ML as a single rule allowed from any to any. If you want to know the sources and destinations then you can apply Rule Enrichment. We do that because those apps can represent the 60% of the total traffic and at the time to analyze you can exclude them if you want meaning we will only consider the 40% of the traffic just for the analisys.
11-27-2018 08:14 AM
Hi Bruno, Common Apps are taken in that way, apps like ping, dns that generates tons of logs are considered by ML as a single rule allowed from any to any. If you want to know the sources and destinations then you can apply Rule Enrichment. We do that because those apps can represent the 60% of the total traffic and at the time to analyze you can exclude them if you want meaning we will only consider the 40% of the traffic just for the analisys.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
