Recommended action for real-time-detection URL category

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Recommended action for real-time-detection URL category

L4 Transporter

Can you please help me clarify the new real-time-detection category, which is covered by the URL filtering license? 

 

According to the article the Advanced URL filtering  "real-time-detection" URL category is not a classification by itself, but a real time inspection, which can return either Benign or as one of the risky category types, e.g. Parked, High Risk, etc. 

The logging entry with real-time-detection category is rarely s... - Knowledge Base - Palo Alto Netw...

 

Can you please help me clarify the  following:

  1. What is the recommended action  real-time-detection in a URL filtering profile?
  2. Will action "alert" permit any traffic detected by the Advanced URL filtering, regardless of the risk and will setting it to block, also block benign traffic?
  3. Do action "allow" disables real time Advanced URL inspection checks? 
1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hi @batd2 and @Schneur_Feldman ,

 

  1. This document says that the real-time-detection category should be set to alert -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/url-filtering/test-url-filtering-configura... (note under Verify Advanced URL Filtering).  A-URL will then reclassify the URL and the action will be taken according to the new category.  They have URLs to test and see the logs for yourself.
  2. "Alert" will not permit all traffic that matches the category.  As explained in the doc, the most severe action will be taken from all the matched categories.  "Block" will block all traffic that matches the category because it is the most severe action.
  3. "Allow" does not log.  So, it makes sense that it disables real-time checks that match this category.  Inline Deep Learning (10.2) https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-new-features/url-filtering-features/cloud-inlin... is also part of A-URL.  So, I don't think it completely disables A-URL.

Like you, I would like to see this recommendation under the URL BP page -> https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/url-filtering/url-filtering-best-practice....

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

View solution in original post

6 REPLIES 6

Cyber Elite
Cyber Elite

@batd2,

Personally, I have every single category that isn't blocked set to alert. Whatever action you have set, the most restrictive will be the action taken. So if you have real-time-detection set to alert and it's identified as real-time-detection and malware (which you hopefully have set to block) the traffic will be blocked. If you have real-time-detection set to alert and then you get a benign category like social-media that you have set to allow then you would simply alert on the traffic and it would be logged but no action would be taken.

 

You could alternatively set real-time-detection to allow and the other category identified will always take precedent. If I recall properly this is what the default action for real-time-detection is on the firewall and likely what PAN would recommend since it'll never be the sole detection. 

L4 Transporter

@BPry Thank you for your response. Maybe I am missing the point of having the "real-time-detection" category, since the traffic will be classified as Malware, Phishing, etc. My understanding was that the category is used to control if traffic is being sent to Advanced URL filtering servers. Do you think that the queries are sent to the server for inspection, regardless of the the action for real-time-detection? 

L3 Networker

@BPry  That does not make a lot of sense. Does anyone have a good explanation as what action for real-time-detection URL category should be set to?

L3 Networker

Also I tested it. Seems like Real Time needs to be set to Block.

Cyber Elite
Cyber Elite

Hi @batd2 and @Schneur_Feldman ,

 

  1. This document says that the real-time-detection category should be set to alert -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/url-filtering/test-url-filtering-configura... (note under Verify Advanced URL Filtering).  A-URL will then reclassify the URL and the action will be taken according to the new category.  They have URLs to test and see the logs for yourself.
  2. "Alert" will not permit all traffic that matches the category.  As explained in the doc, the most severe action will be taken from all the matched categories.  "Block" will block all traffic that matches the category because it is the most severe action.
  3. "Allow" does not log.  So, it makes sense that it disables real-time checks that match this category.  Inline Deep Learning (10.2) https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-new-features/url-filtering-features/cloud-inlin... is also part of A-URL.  So, I don't think it completely disables A-URL.

Like you, I would like to see this recommendation under the URL BP page -> https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/url-filtering/url-filtering-best-practice....

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

L6 Presenter

I suggest watching the https://register.paloaltonetworks.com/nebula-tech-deep-dive-series sessions that will give you some deep dive.

  • 1 accepted solution
  • 5693 Views
  • 6 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!