Is Traffic Pattern / behavior based detection is possible in PaloAlto as in the Cisco,.

[Gururaj]

Hi All,.

Is Traffic Pattern / behavior based detection is possible in PaloAlto as in the Cisco,.

In Cisco it works as fallows,.if we have enabled traffic sensor for particular time period it will calculate the percentage of traffic based on protocols as shown below

HTTP - 30%      FTP - 20%   HTTPS- 50%      and this information will be used in future traffic analysis, for eg : If HTTP traffic goes above or below the 30% then it send alerts to administrator and same for the FTP (above or below 20% and HTTPS 50%).

Regards,

Gururaj

[gafrol]

There is no traffic baselining/anomaly detection available in the product at this time. But you could feed traffic logs into splunk and analyse from there.