Threat log

[dmodi]

Hello Team,

In the firewall, it is showing around 4000 threat logs of brute force threat and I am receiving 4000 mail in my mailbox.

Is there any way for specific threat I will receive only one email

[MP18]

As per My experience you can config alerts with severity high or critical.

If any user try to access the same url or file or anyone try brute force attempt you will get email alerts.

There is no way as per my knowledge that for any severity Alert you can get only 1 Email alert.

[OtakarKlier]

Hello,

I would recommend sending the logs to your SIEM and set thresholds there. Also you can set the PAN to block these attempts for up to an hour. This is configured in you Anti-spyware policy as well as Zone Protection policy.

Regards,

[dmodi]

I want to replicate so please let me how I can configure email forwarding with trail email gateway. Let me know any website providing email gateway trial

[MP18]

You can use any website like

yahoo.com

gmail.com

I am using my webmail. shaw.ca as long as you know the email gateway. for example for my email at shaw.ca the email gateway is 

mail.shaw.ca

Try this with yahoo.com email address if you have ?

[dmodi]

[MP18]

IT should work as long as email server is reachable and traffic is allowed from your Firewall.

This email alert will go via Management plane of the firewall.

Please check below link

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUiCAK

[dmodi]

Tried with yahoo gmail but still getting same issue.

Please let me know how i can configure local mail server then i want to use that email server as an gateway or http server will also work to check the behavior of log forwarding

[MP18]

My Internet Provider  it works as shown below

For Yahoo and Gmail I do not know their settings.

[dmodi]

I tried with yahoo and Gmail but not worked. I tried to create an account in mail.shaw.ca but they need some account number and info. Anyone, please provide mail.shaw.ca account for testing purpose or let me know any other free service provider to replicate the issue

[MP18]

I also tested yesterday with yahoo account it does not work.

For testing purposes you can use my email info.

You need to have Internet connection with them in order to create an email account.