This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About u2521
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About u2521
08-18-2015
11Posts
1Like
0Solutions
Aug 18, 2015Last Visited
User
Activity
User
Profile
Latest posts by u2521
| Subject | Views | Posted |
|---|---|---|
| 1774 | 05-26-2010 05:22 AM | |
| 2009 | 05-26-2010 05:19 AM | |
| 3566 | 05-26-2010 04:00 AM | |
| 2019 | 05-26-2010 03:59 AM | |
| 5578 | 03-10-2010 02:41 PM | |
| 7653 | 03-09-2010 05:38 AM | |
| 3566 | 03-09-2010 05:14 AM | |
| 3764 | 03-05-2010 01:45 AM | |
| 4053 | 03-03-2010 03:08 AM | |
| 2331 | 02-04-2010 04:18 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 03-09-2010 05:38 AM |
User Badges
Community Statistics
| Member Since | 10-21-2009 10:24 PM |
| Date Last Visited | 08-18-2015 09:06 AM |
| Posts | 11 |
| Total Likes Received | 1 |
05-26-2010
05:22 AM
Hi PANOS ver: 3.0.5 Device: PA-2020 Exported traffic logs contains information about which protocol is used, however if the protocol is ICMP the type and code is not displayed. I a specific case im looking at right now both application and protocol is icmp which makes it hard to know if its a echo request or something else...
... View more
05-26-2010
05:19 AM
Hi PANOS ver: 3.0.5 Device: PA-2020 Did some exports of the sublogtype: URL and got the following columns/fields: Domain,Receive Time,Serial #,Type,Threat/Content Type,Config Version,Generate Time,Source address,Destination address,NAT Source IP,NAT Destination IP,Rule,Source User,Destination User,Application,Virtual System,Source Zone,Destination Zone,Inbound Interface,Outbound Interface,Log Setting,Time Logged,Session ID,Repeat Count,Source Port,Destination Port,NAT Source Port,NAT Destination Port,Flags,IP Protocol,Action,URL,Threat/Content Name,Category,Severity,Direction 1. It would be great if the log would contain: user-agent referrer sent/received bytes 2. The URL Column seems to be chopped at 64 chars If these features has been added into 3.1 please disregard this post.
... View more
- Tags:
- logging
- url_filtering
05-26-2010
03:59 AM
Any news regarding the ability to view the "matching pattern" or settings for brute force and scanning signatures directly in the GUI ? Will this be available in future versions? The ability to view the "matching pattern" is very helpful in deciding if the alarm is a false positive or not. If you have pcap active and can see the "matching pattern" you can make up your own mind if its a FP or not. //Henrik
... View more
03-10-2010
02:41 PM
Hi Thank you for the reply. Im glad you are working on getting the settings into the product Some clarification for #4 I'm talking about the signatures that are in the product that look for data patterns for example some sort of buffer overflow. In other products like Cisco, Juniper etc etc you are able to view the "matching pattern" (in regular expression format) for some signatures. Some of the signatures are "protected" because the vendors have agreements with Microsoft etc etc so the vendors are not allowed to give the matching patterns out. What i'm asking for is the ability to view "what a signatures matches" for all signatures except those you need to protect (encrypt). Also the possibility to change the "matching patterns" on a signatures provided by you would be totally awesome!! The basic use for that function would be to tune the signatures ourself until we have had time to contact you about a signature that generates alot of false positives and you have tuned the signatures and sent out a new update //Henrik
... View more
03-09-2010
05:38 AM
1 Kudo
Box: PA-2020 (probably all) OS Version: PANOS-3.0.6 Hi! I have some questions and suggestions for the threat-ips part of the box. 1. Ability to view settings for scanning and brute force signatures. - What are the settings for these signatures? I cant find for instance how many attempts/ips/ports is needed for the signature to trigger. 2. Ability to change settings on brute force and scanning signatures. - Sometimes you want to change the default behaviour of a signature. For instance we want to change how many attempts a client needs to do before a brute force signature triggers. This is also applicable for scanning signatures. 3. More detail in signature summaries - When looking at a SSH Brute force alarm, it states "count": 1. If its only 1 attempt its not a brute force attack When checking the packet-capture data we only see 1 packet. It would be great to get more information of these "summarizing, threshold" signatures. 4. Regexp signatures - The ability to view the regular expressions on signatures that you don't need to protect would be nice. //Henrik
... View more
Labels:
- Labels:
-
Configuration
03-09-2010
05:14 AM
Great, thanks Marcel. If you also could add it to the "threat-logs" aswell that would be super-great //Henrik
... View more
03-05-2010
01:45 AM
Hi Thank you for your reply. Unfortunately the point of checking the vlan field in the monitoring logs its to feed another system with information. This system wants vlan information in order to sort logs into separate containers. And since all traffic are coming in on a TAP port with multiple vlans interface filtering is rellly not applicable. Since we get the logs either by syslog or scp/cli access is there a way to see the vlan information in the cli with the "show logs" or something? And also, do you have any plans on implementing vlan information in the monitoring logs in the future? //Henrik
... View more
03-03-2010
03:08 AM
Device: PA-2050 OS: PANOS-3.0.6 Hi I have a question about Vlan. In the different logs you cant find "source vlan" anywhere. I belive this is cause Palo Alto is a zone based firewall and you should use zones to separate different network types rather than interfaces and vlans. However... When doing troubleshooting, vlan information would be really good in the traffic and threat logs. And when you connect a Palo Alto using a tap port you cannot even create different zones for different vlans cause the TAP interfaces can't be assigned to vlans. The reason i'm asking is because of this scenario: 1 Palo Alto hooked up using 1 TAP port. This TAP port contains several vlans. When i examine the logs afterward it all shows up as the security zone connected to the tap interface. I want to be able to tell which alarms triggered on what vlannumber. /Henrik
... View more
Labels:
- Labels:
-
Configuration
-
Networking
02-04-2010
04:18 AM
Hi thanks for your answer. We would not like to use syslog since that protocol does not have any security in it, if a link goes down we will lose data. The ftp and scp export command in the cli are good, but as you say they are hard-to-use for realtime operations. Do you know if there is a say to send command to the cli directly just like you can with normal ssh shells like bash? for instance: ssh user@box "ls -la /" if you could do: ssh user@box "<command for outputting a specified amount of logdata to STDOUT>" This would make a pretty good say to pull logs from the machine using for instance a python script. However, the best way would be access to logs using the REST api. //Henrik
... View more
10-22-2009
02:47 AM
Hi 1. Getting the data I have been researching a way to get threat logs from the system using the RESTful API as a carrier. It seems you can access reports and configuration this way but not the "raw" logs. The "raw" logs are accessable through the CLI it seems, for instance you can get data by issuing this command: show log threat csv-output equal yes start-time 2009/10/22@10:00:00 I would be great if you could get this same output through the RESTful API aswell. 2. Proposal "uniqe-log-row-id" When getting data from the logs you are able to restrict the output to alot of different things like source, dest, application, etc, etc. When implementing some kind of automated log-retrieval system i would be really cool if each log-row had an uniqe ID and you could place the following command to the CLI (or RESTful API) show log threat csv-output equal yes since-id equal <unique-id> This would allow a system to uninterrupted get data from the device even if the retrieval application goes offline for awhile. Does anyone know of a way to solve problem 1 or 2 with the features that are available now.
... View more
- Tags:
- logging
- management
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks