How to report traffic logs for a specific rule ?

[ldormond]

Hello,

I have defined several specific policies to allow traffic through my PA device.

I have also created a rule that allow any traffic (at the end) to not impact current traffic.

My idea is to be able to identify all traffic that flows through my device through this "allow any" rule and then create specific rules for legitimate traffic.

I have a lot of traffic passing through my "allow any" rule. It is pretty unfriendly to go to the monitor tab and load the filter for this rule and then analyze logged traffic.

Also my question is : how to create a scheduled report for all the traffic flowing through my "allow any" rule (there are dozen of pages ?

And in a general manner : how to create custum scheduled report for any specific rule ?

I have tried to achieve this using the custom report section by defining filter on a specific rule, but unfortunatly it only allows to display top 10, top 100 ..reports.

Regards,

Laurent

[bpappas]

@Laurent:

I would advise having a daily report for the top 25 applications that match your any-any-allow rule. Each day review this report and create specifc allow/deny rules for the applications based upon the desired behavior in your network.

-Benjamin