How to Check for NTLM traffic in the network

[VishwasAkbilwam]

Hi,

We have Palo Firewalls in our remote offices and data centers. I have been asked to check if NTLM is still being used in our network.

Any idea how can we check for the NTLM traffic  in firewall traffic logs?

Thanks

Vishwas

[Raido_Rattameister · Accepted solution]

Check that your security profile logs 92322 events for internal traffic and then filter threat log using  ( threatid eq '92322' ).

[VishwasAkbilwam]

Thank you for the suggestion. I was able to search and see the NTLMSSP traffic.