How to monitor threats for Panorama traffic

[Maria-Victoria]

Hello,

We can check if a fw is hitting some vulnerability checking the monitor threat tab, I would like to know if there is a way to check the same think for panorama traffic, thanks in advance.

Regards

[PavelK]

Thank you for posting question @Maria-Victoria

Panorama does not have any data plane and is not processing any traffic like Firewall does. If you mean checking of the logs from Firewalls, then as long as Firewall is registered in Panorama and sending Threat logs you should be able to see it under: Monitor > Logs > Threat.

If you are referring to something else could you please provide more details what you are looking into?

Kind Regards

Pavel

[Maria-Victoria]

Hello,

Pavel, thank you for your answer.  What I mean is that, for example if there is a vulnerability "x" I can check in monitor>  threat  if a fw is suffering an attack due to this vulnerability using the next filter cve eq CVE-number, But If panorama is affected to this vulnerability, how could we perform the same check for panorama?

[PavelK · Accepted solution]

Thank you for quick reply @Maria-Victoria

Since Panorama does not have any firewall feature and does not process any data plane traffic, there is no equivalent in Panorama what you are used to see in regular Firewall with Threat logs. Panorama can't check itself for vulnerability. 

I would recommend to check this security advisory: https://security.paloaltonetworks.com/CVE-2021-44228 based on your PAN-OS version and deployment mode to confirm whether you are affected or not. As time progress Palo Alto is going to provide update on hotfix for PAN-OS versions that are affected.

Kind Regards

Pavel