Question about Paloalto External Dynamic List

[JoHyeonJae]

Hello all,

I hope you are doing well : )

I recently received an EDL-related question from a customer, but I couldn't find an answer, so I want to ask for advice.

The customer's configuration is the configuration set by the blacklist IP on the EDL

However, the blacklist IP should be checked in the traffic log, but it can be checked in the treatment log.

Is this expected action?

Then can you tell me why the log is recorded in the Treat log tab?

(EDL)

 

(Security Policy)

(Treat log)

Thanks!

[OtakarKlier]

Hello,

I would suggest they use the 'Unified' log. This shows all the other logs all together. I find its more helpful than jumping from different logs, etc.

Another thing they could try is to put a 'Tag' on the policy that utilizes the EDL. This way they can just filter by the 'Tag'

Regards,

[JoHyeonJae]

@OtakarKlier 

Thank you for sharing the information.

If so, is it normal work for the IPs set in the EDL to be logged in the Treat log?

[OtakarKlier]

Hello,

I honestly do not know, but would be nice if someone who does can chime in @kiwi  or @reaper ?

I would only speculate that if the EDL is in a DENY policy, it would show up in the threat logs.

Regards,

[JoHyeonJae]

@OtakarKlier
Thank you for replying 
.
I have tested EDL in a DENY rule, it is displayed in the Traffic logs.