About BenKnorr2

PanOS 10.2.3-h2 I've configured CIE in Panorama; it shows Enabled. All behavior I see is exactly like all others in this thread. Via CLI, I have zeros on everything relating to CIE.   On the same config elements on a firewall (also connected/managed by panorama FWIW), I have configured in the same way. CLI shows zeros just like with panorama. But... creating a security policy on the firewall and browsing groups shows all groups synched from azureAD. It's there. I haven't found documentation about the CLI commands, nor any relating to CIE and group-mapping beyond "here is a section where you can pick what attributes a group is in your cloud environment."     I double checked this on Panorama by way of creating a sample security rule and browsing for source groups and I got nothing on that end. ... View more

Instead of going Devices>Panorama>M.Learning , go Devices>Panorama>expand list>[FW in question] Not sure if you're doing this already but your screenshots show Panorama instead of FWs themselves. I'm not sure how the GUI is supposed to work where Panorama is managing firewalls in this regard, but in my experience with ML and Panorama, I go this route to configure the log ingestion processing for ML on each FW. Config for rules comes via syncing it from Devices>Panorama as normal. ... View more

How about dynamic IP tagging based on info from threat logs? https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-auto-tagging-to-automate-security-actions.html   In a nutshell, you have a log forwarding profile that hits on whatever threats you want (medium and higher, etc.), and it can do several things: forwards to syslog/panorama/datalake, sends admin an email alert, sends SNMP trap, tags the IP. You will make an address group based on this tag and create a security rule that blocks this traffic, sends to an alert page, etc. The duration of block is determined in the log fwd profile. ... View more

There is an Expedition v2.0 that is based on Ubuntu 18.04LTS. It has been easier to deploy from the previous iteration; cheers to the Palo Alto crew that put this together!   https://panos.pan.dev/docs/expedition/expedition_qs  ... View more

Replied too fast just now!   I typically go slowly when building filters and sorting the machine learning results in greenfield. Personally I like to add application column, group by dst-address or src-address, then sort on that field. Can use default view that groups by app to show some higher-risk apps like rdp or ssh and start breaking rules out like that, but I usually end up grouping by IP since customer has inventory that they are working from and we go down that list to make sure we cover everything. My case is assuming 5000+ hosts in the environment, so the recommendations get noisy.   Once you're grouping by IP, can easily add filter there. FWIW, the filters aren't amazing (10.10.10.10 will match 10.10.10.100 too), but they help a ton if you can layer the filters on results. ... View more

In your project, in the M.Learning tab, you can set your enabled networks to only include internal stuff that you want to make rules for. Once you have analyzed the enabled networks, doing m.learning on any policies should only reflect that new ip space. ... View more

I only have Panorama set in devices, but the managed firewalls have been retrieved within it. Goal is to take rules from panorama device groups and use ML on traffic.   There is no place to set "after processing" action for the firewall themselves in expedition when panorama is the device in question. Am I missing something there and this isn't supported in the first place? ... View more

Thanks for the response. Unfortunately, no, permissions have been consistent and what appears to be correct since beginning. In Expedition GUI / Settings /M.Learning, there is a blurb at the bottom for CSV and file rights: Scheduled Log Export from FW devices may export your log files as expedition owned files. In case you want to activate delete after processing the CSV logs, make sure that www-data has write rights over the files. You can achieve it by adding the following into your root cron (the following example will verify the file rights every day at 00:05 am): 00 05 * * * * php /var/www/html/OS/spark/scripts/changeCSVLogRights.php I entered this in my crontab (syntax shown above looks incorrect though; has an extra *) and it fixes permissions for 660 / chown www-data:expedition for any logs in a project that are set to be autoprocessed but haven't been processed yet. This does work. This step helped in my lab environment to get autoprocessing+deleteafter to succeed.   For what it's worth, here are two log files: one with 770 was set immediately after it was uploaded to expedition prior to processing. The other was set using the built-in script that runs at 00:05 nightly via cron. Both files have since been "auto processed" with "delete after processing" checked, but no deletion occurred after processing. Just showing that 770/660 seem to have no impact on problem. expedition@Expedition:~/logs$ ls -lah total 317G drwxrwxr-x 2 expedition expedition 4.0K Sep 28 15:56 . drwxr-xr-x 5 expedition expedition 4.0K Sep 10 08:41 .. -rwxrwx--- 1 expedition www-data 157G Sep 27 17:39 PA5250-PRI_traffic_2020_09_27_last_calendar_day.csv -rw-rw---- 1 expedition www-data 161G Sep 28 17:50 PA5250-PRI_traffic_2020_09_28_last_calendar_day.csv My lab environment has a FW sending logs via SCP to expedition, and the device in expedition is for the firewall itself w/no panorama. "process enabled files" button in device tab works for manual processing (have another thread on this board about this part). Logs weren't getting deleted until I put the php script in crontab, now it works good.  My prod environment has FW sending logs via SCP to expedition, but the device is panorama with managed devices/config imported to it. "process enabled files" is greyed out and has never been usable, for what its worth, and deleting logs after auto processing has never worked. ... View more

Is this a Panorama thing? The permissions on these files look correct, but the auto processing phase never deletes them. ... View more

Sorry, wasn't clear earlier. I put the ACL fix script shown in Settings/M.Learning in the "CSV log file rights" section. It lists slightly erroneous (one extra *) but otherwise very helpful line to put into crontab to have a built-in Expedition script fix ACLs on filesystem so logs can be deleted after processing. This part does work. An unprocessed imported log file that has expedition:expedition ownership changes to 660 expedition:www-data after running the script. This part has been consistent. ... View more