Is it possible to create the custom report each category in spyware?

[KiCheon.Lee]

Hello

My customer would like to see only CnC threats after the filtering.

So I think to use the filtering for spyware category.

But there are only 'any' and 'unknown' in threat logs.

I want to use the each spyware category such as botnet , backdoor and etc.

How should I do?

Thanks,

KC Lee

[hyadavalli]

Hello Lee,

Palo Alto daily generate a report for spyware under 'Monitor->Reports->Threat Reports.

Is this what you are looking for?

Regards,

Hari Yadavalli

[Phoenix]

Hello cheon,

From the Threat database selected from the custom reports we can set the filters such that we are looking for type "Spyware" and filter all the spyware threat logs.

The allowed Threat types are flood, scan, spyware, virus, vulnerability.

So if we are looking for anything outside these then we have to go for predefined reports as pointed earlier by hyadavalli where we can find the botnet and other reports.

Thanks

[panos · Accepted solution]

I don't think this is supported.There is no way to filter categories.

[KiCheon.Lee]

Thank you for the answser, hyadavalli , Phoenix and panos.

As panos mentioned, I think so too.

I can not filter each spyware category in threat logs or custom report.

But I have gotten some idea for filtering command and control, recently.

I read the spyware phone home detection value of threat id fields are between 10000 ~ 19999 in the integration syslog document.

So I will make the filtering as below in threat logs.

(threatid geq 10000) and (threatid leq 19999)

How do you think about it?

Do you have any idea better than it?

Thanks,

KC Lee