Threat log original destination required in vm firewall deployed in aws ..

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Threat log original destination required in vm firewall deployed in aws ..

L2 Linker

Hi Team,

We have VM firewall deployed at AWS. 

 

>> Paloalto>>ALB>> servers

 

Now in threat log we are getting logs for destination as ALB  because of this architecture.

Is it possible to get logs for actual destination server in threat log by any means ?

 

Thanking you in advance!!

 

 

1 accepted solution

Accepted Solutions

@omprasadax,

You won't be able to get the destination of the actual server if this is being fed through the ALB; as @DelvinC initially mentioned, the firewalls visibility into the traffic stops once the packet reaches the ALB. You will need to have some sort of SIEM (Like Cortex, Splunk, Graylog, ect) to aggregate these logs if you don't want to manually corelate them. 

View solution in original post

5 REPLIES 5

L2 Linker

I don' think you can get logs for actual destination server in the threat logs on the virtual firewall. The virtual firewall's visibility does not go beyond the ALB based on the setup that you have. In the give scenario, you'll need to correlate the timestamps on the virtual firewall and the ALB logs to identify the original destination server.


Another alternative is if you are using Cortex-XDR.

If SSL inbound inspection configured in this case then will it be meaningful?

If we were to look at this problem from a different perspective, what are we trying to achieve by looking at the threat logs? Are you just looking to block the threats or identify the impacted server?

Yes, we want to identify impacted server then if required we would take any other action

@omprasadax,

You won't be able to get the destination of the actual server if this is being fed through the ALB; as @DelvinC initially mentioned, the firewalls visibility into the traffic stops once the packet reaches the ALB. You will need to have some sort of SIEM (Like Cortex, Splunk, Graylog, ect) to aggregate these logs if you don't want to manually corelate them. 

  • 1 accepted solution
  • 3930 Views
  • 5 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!