Data Filtering timers and inner workings

[CMachado]

Hello, Live Community!

I've been using Data Filtering profiles for a while now and they work really well, but it has come to my attention that I don't really know some of the inner workings of it, specially today when someone asked me about it, so...

• Does DF work with timers? I mean, what's the time range for detecting a data pattern/regex/file property and for it to count towards the defined threshold? Is this configurable? If I set an alert threshold of 2 for a CC# and someone transfers one number now and then waits for a week until transferring another one, will the threshold be met?

• To my understanding, DF counts any instance of the data pattern/regex/property towards meetings the threshold, but is this per IP/User identity? Is this configurable?

Looking forward to your replies. Many thanks!

[kiwi]

Hi @CMachado ,

The Alert Threshold and Block Threshold fields specify how many instances of a data match, within a single session, that must be observed before the Palo Alto Networks device performs an alert or block action, respectively.

Source: HOW TO CONFIGURE A DATA FILTERING PROFILE TO ALERT BUT NOT BLOCK 

Cheers !

-Kiwi.