Recommended action for real-time-detection URL category

[batd2]

Can you please help me clarify the new real-time-detection category, which is covered by the URL filtering license? 

According to the article the Advanced URL filtering  "real-time-detection" URL category is not a classification by itself, but a real time inspection, which can return either Benign or as one of the risky category types, e.g. Parked, High Risk, etc. 

The logging entry with real-time-detection category is rarely s... - Knowledge Base - Palo Alto Netw...

Can you please help me clarify the  following:

1. What is the recommended action  real-time-detection in a URL filtering profile?
2. Will action "alert" permit any traffic detected by the Advanced URL filtering, regardless of the risk and will setting it to block, also block benign traffic?
3. Do action "allow" disables real time Advanced URL inspection checks? 

[BPry]

@batd2,

Personally, I have every single category that isn't blocked set to alert. Whatever action you have set, the most restrictive will be the action taken. So if you have real-time-detection set to alert and it's identified as real-time-detection and malware (which you hopefully have set to block) the traffic will be blocked. If you have real-time-detection set to alert and then you get a benign category like social-media that you have set to allow then you would simply alert on the traffic and it would be logged but no action would be taken.

You could alternatively set real-time-detection to allow and the other category identified will always take precedent. If I recall properly this is what the default action for real-time-detection is on the firewall and likely what PAN would recommend since it'll never be the sole detection. 

[batd2]

@BPry Thank you for your response. Maybe I am missing the point of having the "real-time-detection" category, since the traffic will be classified as Malware, Phishing, etc. My understanding was that the category is used to control if traffic is being sent to Advanced URL filtering servers. Do you think that the queries are sent to the server for inspection, regardless of the the action for real-time-detection? 

[Schneur_Feldman]

@BPry  That does not make a lot of sense. Does anyone have a good explanation as what action for real-time-detection URL category should be set to?

[Schneur_Feldman]

Also I tested it. Seems like Real Time needs to be set to Block.

[TomYoung · Accepted solution]

Hi @batd2 and @Schneur_Feldman ,

1. This document says that the real-time-detection category should be set to alert -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/url-filtering/test-url-filtering-configura... (note under Verify Advanced URL Filtering).  A-URL will then reclassify the URL and the action will be taken according to the new category.  They have URLs to test and see the logs for yourself.
2. "Alert" will not permit all traffic that matches the category.  As explained in the doc, the most severe action will be taken from all the matched categories.  "Block" will block all traffic that matches the category because it is the most severe action.
3. "Allow" does not log.  So, it makes sense that it disables real-time checks that match this category.  Inline Deep Learning (10.2) https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-new-features/url-filtering-features/cloud-inlin... is also part of A-URL.  So, I don't think it completely disables A-URL.

Like you, I would like to see this recommendation under the URL BP page -> https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/url-filtering/url-filtering-best-practice....

Thanks,

Tom

[nikoolayy1]

I suggest watching the https://register.paloaltonetworks.com/nebula-tech-deep-dive-series sessions that will give you some deep dive.