Botnet Syslog

[lucaspassos]

Hi guys,

I have a syslog that I make some monitoring dashboards and the customer want one view about all botnets in my network.

I had configured Palo Alto to send the logs to syslog. But I can't found the log about botnet.

Somewhere know how can I do this? What log that we can see the infections?

Thanks for the help!!

Best Regards

Lucas Passos

[kadak]

Hello Lucas,

Botnet Reporting is a threat prevention feature. The PAN collates information from traffic, threat, URL logs to identify botnet-infected hosts. The report generated each day consists a list of infected hosts, description(why we believe the host is infected) and a Confidence level. You can configure the parameters in addition to the query indicating what traffic you'd like to see the botnet report on. There are no Botnet logs, just predefined Botnet reports that run daily.

However, you can configure botnet reports to be emailed out on daily basis according to your email server profile.

Under Monitor > Botnet > Report setting

You can then create report group to include that botnet report

You can then create an email scheduler with email server profile to include that report group

The above process who trigger an email  (botnet report attached to it ) everyday to jdoe@xy.com

Since there is nothing called botnet log, we cannot forward it to any external server.  On another note, you can indeed forward your threat logs to external entities by following the document:How to Forward Threat Logs to Syslog Server

Hope thats helps!

Regards,

Kunal Adak

[lucaspassos]

Hello kadak!

Thank you for the answer. I was think about send email. Really I'll do this. But, it's not the perfect way, because I'll wanted make a dashboard. With the dashboard I'll can monitoring in real time.

Best Regards!

Lucas P

[JohnSilvia]

Have you considered the API on your PA?

Since the botnet report is a predefined report, you can pull it using the API with a URL like this:

https://PA_FIREWALL_IP/api/?type=report&reporttype=predefined&reportname=botnet

With that in play, all you have to do is have something pull that URL (need to add the API auth string to the request first) and change out the IP address with that of each of your firewall modules.  As long as the server (QRadar) for example, is configured to read the XML responses, you can read and act as needed on the report results.

You can pull the CSV's straight out as well - but that takes two requests - one to generate the report and the other to fetch the result.

Cheers.