Scanning network flow using file name

[Interface]

Hello,

Any know an opportunity to scan network flow with PaloAlto to find files by file name? Eg.: i entered "angry tiger" and i find all files (including all file types) with that name sent over the network.

[VinceM]

Hi,

If you want to search file name, you ave to go through data filtering profile.

The easiest way to do it is to use regex? With this method you can search all what you want.

Eg: https://live.paloaltonetworks.com/docs/DOC-4860.

Just keep in mind that you can't search string with size  under 7.

Hope help.

V.

[Interface · Accepted solution]

I found one solution: i must log all file types using File Blocking profile (File Type -> any, Action -> alert) and then in a Data Filtering log i can find file using file name. Not ideal, but works

[VinceM]

Hi,

yes you can do that, very usefull for auditing 🙂

Maybe upload logs to syslog server and make a script for sending an alert

V.