Threat log original destination required in vm firewall deployed in aws ..

Reply
Highlighted
L1 Bithead

Threat log original destination required in vm firewall deployed in aws ..

Hi Team,

We have VM firewall deployed at AWS. 

 

>> Paloalto>>ALB>> servers

 

Now in threat log we are getting logs for destination as ALB  because of this architecture.

Is it possible to get logs for actual destination server in threat log by any means ?

 

Thanking you in advance!!

 

 


Accepted Solutions
Highlighted
Cyber Elite

@omprasadax,

You won't be able to get the destination of the actual server if this is being fed through the ALB; as @DelvinC initially mentioned, the firewalls visibility into the traffic stops once the packet reaches the ALB. You will need to have some sort of SIEM (Like Cortex, Splunk, Graylog, ect) to aggregate these logs if you don't want to manually corelate them. 

View solution in original post


All Replies
Highlighted
L2 Linker

I don' think you can get logs for actual destination server in the threat logs on the virtual firewall. The virtual firewall's visibility does not go beyond the ALB based on the setup that you have. In the give scenario, you'll need to correlate the timestamps on the virtual firewall and the ALB logs to identify the original destination server.


Another alternative is if you are using Cortex-XDR.

Highlighted
L1 Bithead

If SSL inbound inspection configured in this case then will it be meaningful?

Highlighted
L2 Linker

If we were to look at this problem from a different perspective, what are we trying to achieve by looking at the threat logs? Are you just looking to block the threats or identify the impacted server?

Highlighted
L1 Bithead

Yes, we want to identify impacted server then if required we would take any other action

Highlighted
Cyber Elite

@omprasadax,

You won't be able to get the destination of the actual server if this is being fed through the ALB; as @DelvinC initially mentioned, the firewalls visibility into the traffic stops once the packet reaches the ALB. You will need to have some sort of SIEM (Like Cortex, Splunk, Graylog, ect) to aggregate these logs if you don't want to manually corelate them. 

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!