What software is going to replace the Expedition M.Learning feature after the announced EoL of Expedition (Jan 2025)?

[mlaserman]

For instance, we were going to use the ML feature of the Expedition (with live traffic log forwarding to the Expedition VM) with the objective to create granular security rules. With Expedition EoL, what tool (if any) will provide this functionality? The tool should have an on-prem deployment option to keep both log traffic and log data inside the corproate network.

[FBuijs]

We have the built-in Policy Optimizer (starting with PAN-OS 9.0) that will help you build more granular rules (based on actual traffic as seen by the firewall). No need to install anything extra

[mlaserman]

Hi FBuijs,

Thank you for your reply.

I was following the Expedition log analysis guide (https://live.paloaltonetworks.com/t5/expedition-articles/expedition-documentation/ta-p/215619?attach...). It does suggest using PAN-OS 9.1 or later instead of Expedition for the use case #1. I'm looking into the use cases #5 and #6, which suggest using Machine Learning (ML) feature of the Expedition itself. Could you point me please to the documents which provide guidance on the built-in (or add-on) PAN-OS features on par with Expedition ML?