M.Learning Analysis results empty

[chris.weakland]

Currently I have a Panorama managed firewall, I have added Panorama to Expedition (Running v1.2.86), and I am sending syslogs from the firewall to Expedition. Logs are showing up and are being processed:

I have a project created, Panorama configuration imported, I can see the ruleset for the firewall in question. I have the log connector set to Panorama and the device group for the firewall selected.

In the policy, I have enabled ML on the rules I am interested in. However, when I run the analysis, I get an empty result:

Can anyone chime in on how to resolve this issue?

Thanks,

Chris

[sanandh]

There are couple of things to double check:
- Verify the logs have the serial number matching the serial used to initiate the ML analysis. In case of HA pairs, the logs could be using a different serial.

- Verify there are logs for the rule you are analyzing . If there are no matching logs, the analysis result will be empty

[dpuigdomenec · Accepted solution]

Hi @chris.weakland I guess your issue is related to what @sanandh mentions regarding the FW serials matching. So besides his comments, please do below:

1) Edit your Panorama and set it up as "vm-panorama".

2) Open your project again, go to plugins and create a new log connector, in this case you should be able to select the device, the source file and the DG but also selecting the FWs. See attached screenshot for reference.

Hope this helps,

David

[chris.weakland]

Thank you David, that did the trick!