Threat log original destination required in vm firewall deployed in aws ..

[omprasadax]

Hi Team,

We have VM firewall deployed at AWS. 

>> Paloalto>>ALB>> servers

Now in threat log we are getting logs for destination as ALB  because of this architecture.

Is it possible to get logs for actual destination server in threat log by any means ?

Thanking you in advance!!

[DelvinC]

I don' think you can get logs for actual destination server in the threat logs on the virtual firewall. The virtual firewall's visibility does not go beyond the ALB based on the setup that you have. In the give scenario, you'll need to correlate the timestamps on the virtual firewall and the ALB logs to identify the original destination server.

Another alternative is if you are using Cortex-XDR.

[omprasadax]

If SSL inbound inspection configured in this case then will it be meaningful?

[DelvinC]

If we were to look at this problem from a different perspective, what are we trying to achieve by looking at the threat logs? Are you just looking to block the threats or identify the impacted server?

[omprasadax]

Yes, we want to identify impacted server then if required we would take any other action

[BPry · Accepted solution]

@omprasadax,

You won't be able to get the destination of the actual server if this is being fed through the ALB; as @DelvinC initially mentioned, the firewalls visibility into the traffic stops once the packet reaches the ALB. You will need to have some sort of SIEM (Like Cortex, Splunk, Graylog, ect) to aggregate these logs if you don't want to manually corelate them.