Traffic Logs - Multiple IP's

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Traffic Logs - Multiple IP's

L1 Bithead

Hi,

 

Is there an easy way to monitor traffic logs on say 20 IP's to see if any IOC's are being hit? I'm guessing I could build a filter for each IP but I was hoping there might be a way to do it easier. These are not contiguous IP's so CIDR won't help me.

 

Thanks,

James

2 REPLIES 2

Cyber Elite
Cyber Elite

Why just not use ( addr.src in 10.0.0.0/8 ) assuming you use 10. in your lan.

 

Or build more complex filter.

Below one will show if any of those IPs have web-browsing on some other port than 80 or ssl not on 443.

(( addr.src in 1.1.1.1 ) or ( addr.src in 2.2.2.2 ) or ( addr.src in 3.3.3.3 )) and ((( app eq web-browsing ) and ( port.dst neq 80 )) or (( app eq ssl ) and ( port.dst neq 443 )))

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

What about creating a new rule where you attach your IOC IP's? To make the management of these IP's even easier you could use an EDL (text file which palo will fetch from a webservet). This way you can simply edit the textfile when you have new IP's or when you want to delete old ones and the fw will get the updated list into the running config without a commit.
In the monitor tab you will then filter on this new rules name or you could also attach a custom logforwarding profile to forward hits to this rule via email/syslog/snmp-trap/http
  • 4154 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!