Threat log forwarding from unlicensed PA device?

[OMatlock]

Hi folks,

I believe I know the answer, but wanting to make sure I understand.  I am configuring log forwarding to a Varonis server for testing.  I've been sending the traffic log, but Varonis will only process the Threat log.  

I've configured the Threat in the Log forwarding profile, Vulnerability profie, etc and assigned it to my security rule, but my threat log is empty in general.  I assuming this is because my device is unlicensed?  Pa200 7.1.15.  I guess I was hoping that something (anything) would go through.

Just checking if there are comments before I give up for now.  🙂

[SCantwell_IM · Accepted solution]

Agreed that without a license, you will not get the AV/Spyware/Vuln signature to match.

You could test with enabling Zone Protection Profile and DoS Protection Policies and force an attempted ping flood attack or port scan, or whatever... something that would "hit" as a threat in the logs, but does not require a licensed feature from PANW.

Thanks

[MP18]

I think you can forward the threat logs  without having the threat license.

[RobinClayton]

Without a licence there are no threats to forward.