Generate traffic report to identify any suspicious traffic

[Meng_Kiat_DOS-GCC]

Hi members,

I would like ask if there is way to generate a traffic report for palo alto firewall to show case if the network traffic had any suspicious attack or abnormal traffic for past 1 year ? additionally i have a panorama manage the firewall , is there any use full predefinde report that can show if there is any abnormal or suspicious attack traffic ? 

Thank you

[Claw4609]

Hello,

That depends what your exactly looking for, what is considered suspicious, and if you maintain logs for a year. On both the firewall and Panorama if you go under the Monitor tab there is some information under "App scope". If you look at the way bottom of the monitor tab you can view the predefined reports. To view a year of history I believe you'll need to create a custom report and filter for what you'd like, for example maybe you're looking for critical threats it may look something like this.

Also if you utilize ai-ops (would recommend using this if not already) you can pull various reports related to threats from this as well. Again just kind of depends exactly what you're looking for.

Generate Custom Reports (paloaltonetworks.com)