Threat Log filter by 'Name' field

[CafNetMatt]

I've got a potential client that is trying to filter the threat log by the threat 'Name' field.  He wants to see all from a specific threat.

Normally you click on the item and it puts it in the filter bar but here when you click on the name you get a pop up with the details on that threat.  I've tried a bunch of combinations and can't find anything that will filter on the threat name.

Is there syntax for that field?  Another way to filter that traffic?

Thanks.

Matt

[emr_1]

You can use Threat ID instead.

If you click threat Name, you can see threat detail.

This window contain threat ID.

You can use this as follow:

(threatid eq xxxxx)

Regards,

[UhMayYeah · Accepted solution]

Agree with emr

You can alternatively just choose the Threat Id from the Available columns in the Threat logs as shown in the Snapshot.

Threats details can also be searched from the Threat Vault.

https://threatvault.paloaltonetworks.com/

[CafNetMatt]

If I could do two correct answers I would've.  I had to choose and being lazy like all good net engineers, I chose the path of least resistance.  I added the column.  But, both worked and worked perfectly.

Thank you both!

[craymond]

There should be the capability to filter using text from the Name field also. If you want to search for, let's say, Microsoft vulnerabilities, you should be able to filter using the name field. This would allow an admin to find out what vulnerabilities are trying to be exploited and whether clients or servers have been patched for those vulnerabilities.

[cmaier]

+1 for the ability to search on threat name and use some sort of wildcard language.