send alerts when large files uploaded

[dvu5103]

Hi all,

   Please help to config in PAN devices a rule to send alerts to admin when large files, say geq 100Mb, are uploaded to Internet.

Thank you.

[hshah]

Hello DVU,

If file has any threat content than firewall generates alert.

It doesnt generate any log for larger file, Its not possible as of now.

Regards,

Hardik Shah

[HULK]

Hello Dvu5103,

You can create a custom signature for the same:

For an example:

----Go to Object > Custom Objects > Vulnerability and click Add ( Set default action to "alert")

----Go to the Custom Vulnerability Signature > Signatures tab and click Add

----In the window that appears, create a custom signature with 'And condition'.

---In the Standard window, click 'Add Or Condition' and set 'Operator to Greater Than'

---Set an appropriate context.

----You can add this profile in a security profile.

You can post a request to our development team ( Dev-Center), they will be able to help you for the same, else contact with your Palo Alto Networks SE, he will guide you.

Thanks.

[dvu5103]

In order to protect our information, we need to monitor all upload activities to Internet. So it's not possible in PANs ?

Thank you.

[dvu5103]

Thanks, Hulk. I will study your guidance.

[hshah]

Hello DVU5103,

It would be hard to specify file size as a parameter in vulnerability custom signature. Hence as HULK said it would be good idea to contact SE.

Regards,

Hardik Shah

[mivaldi]

You can not do alerts, but you can have a daily report for sessions with large data transfers. You will get the information you need the next day.

Go to Monitor > Manage Custom Reports

Add a custom report selecting Database=Traffic Log, Time Frame=Last 24 hours, sort by Bytes, add a query statement with the query builder to have Attribute Bytes, Operator greater or equal than, and add the value.

Then set up your Email Scheduler to have the report be delivered Daily. These will generate every day at 2:02am.

[hshah]

Hi Mivaldi,

This appears to be a faster workaround.

Regards,

Hardik Shah

[HULK]

Lets try with these available contexts:

This doc will give you some guideline too: Custom Application Signatures

Thanks