log at session end?

cancel
Showing results for 
Search instead for 
Did you mean: 

log at session end?

L4 Transporter

I have around 500 policies having 'log at session end' enabled and 'log at session start' disabled. I know Palo recommends logging at session end only but I also have a concern that for eg. a malicious file export that lasts for 8 hours and 10gigs go unnoticed if the session wasn't logged at the start. I am in a dilemma to enable the logging at start or not. Please shed some light on this.

Thanks.

1 ACCEPTED SOLUTION

Accepted Solutions

Cyber Elite
Cyber Elite

@SThatipelly,

So the thing to keep in mind is that (in a normal configuration) the firewall will be analyzing the session looking for things like vulnerabilities or malicious files already. If it identifies anything, it'll generate the log for the identification and likely close the session at the same time depending on how you have things configured. 

In the event that you simply want to know that you have a long-running session being used to transfer files, logging at session start really wouldn't give you any additional information there through traffic logs. It's just going to log the start and end of the session. You really need to be monitoring the current sessions traffic to really can actionable information from that regard, which would generally be done via netflow monitoring or using SNMP/API to monitor the session table. 

View solution in original post

1 REPLY 1

Cyber Elite
Cyber Elite

@SThatipelly,

So the thing to keep in mind is that (in a normal configuration) the firewall will be analyzing the session looking for things like vulnerabilities or malicious files already. If it identifies anything, it'll generate the log for the identification and likely close the session at the same time depending on how you have things configured. 

In the event that you simply want to know that you have a long-running session being used to transfer files, logging at session start really wouldn't give you any additional information there through traffic logs. It's just going to log the start and end of the session. You really need to be monitoring the current sessions traffic to really can actionable information from that regard, which would generally be done via netflow monitoring or using SNMP/API to monitor the session table. 

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!