- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
03-07-2024 06:11 AM - edited 03-07-2024 06:12 AM
Hi there,
I had setup Log forwarding profile, where I am sending All logs to syslog server. Thats working great.
Then I added one more line where I am filtering threat logs for (severity eq critical) and (zone.src eq internet_zone)
Checking filter results by Filter Builder and its showing exact values which I am looking for
Then I added Build-in Actions and want tag source address with tag "Hacker-IP"
I have dynamical address group "Auto Blacklist Attacker" where Match is setup for "Hacker-IP" tag.
After a week of trying none of IP addresses has been added to this Address Group. But as you can see from checking filter setup there were plenty of hits...
I tried manually add tag "Hacker-IP" to one of my address-object and automatically showed in dynamic group.
Why is Auto-tag not working in Log forwarding profile? Do I missed something?
Thank you for your help.
Model: PA-440
Software: 10.2.6
04-16-2024 06:28 AM
Did you ever figure this out? I'm on 10.2.9-h1 and same thing. Bug?
08-07-2024 10:49 AM
I am seeing the same issue on versions of 10.2.x and 11.1.x. This is seen on PA400 and PA3400 series firewalls. I have tried configuring from Panorama and locally on the firewall itself. Nothing make a difference.
08-16-2024 12:36 PM
We ran into the same issues and found that addresses are not added to the dynamic group until the group is applied to a security policy. Once I added the group as the source to a security policy all the auto-tagged IPs showed up in the group.
08-19-2024 01:05 AM
Hello,
Same behavior as for EDLs 😉
08-21-2024 12:56 AM
Wow! Well..... yes. Thanks!
I've been so focused on testing and implementing this step by step, that I never added it to a policy (because the dynamic group was allegedly empty). It's now working as expected (just like the EDLs)!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!