Log forwarding - Filtering and Auto- tag not working

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Log forwarding - Filtering and Auto- tag not working

L0 Member

Hi there,


I had setup Log forwarding profile, where I am sending All logs to syslog server. Thats working great.



Then I added one more line where I am filtering threat logs for (severity eq critical) and (zone.src eq internet_zone)



Checking filter results by Filter Builder and its showing exact values which I am looking for



Then I added Build-in Actions and want tag source address with tag "Hacker-IP"



I have dynamical address group "Auto Blacklist Attacker" where Match is setup for "Hacker-IP" tag.



After a week of trying none of IP addresses has been added to this Address Group. But as you can see from checking filter setup there were plenty of hits...


I tried manually add tag "Hacker-IP" to one of my address-object and automatically showed in dynamic group.


Why is Auto-tag not working in Log forwarding profile? Do I missed something?

Thank you for your help.



Model: PA-440

Software: 10.2.6



L2 Linker

Did you ever figure this out? I'm on 10.2.9-h1 and same thing. Bug?

  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!