About dgildelaig

dgildelaig · ‎09-30-2020

Version 1.1.82 is already published

dgildelaig · ‎09-30-2020

Hi, I will check that this is coming in the 1.1.82, which I will release tomorrow or Friday

dgildelaig · ‎09-28-2020

Have you verified that the device that reported those logs has the After Process action set to delete? Maybe you had it for the Panorama, but the device says something else, and we will take action based on what the device states.

dgildelaig · ‎09-24-2020

I would like to collect a bit of information about this issue. Could you share thePANOS version that got affected in this issue?

dgildelaig · ‎09-09-2020

Hi, Yes, this is possible using Expedition as a Syslog server and using a Log Forwarding profile as you stated. To make sure that Expedition is receiving the traffic logs using syslog messages, check this other thread where we mentioned how to set up these parts. https://live.paloaltonetworks.com/t5/expedition-discussions/expedition-as-syslog-server-change-logs-directory/td-p/244974

dgildelaig · ‎09-03-2020

The plan is not to provide a version for a specific alternative platform as RedHat, but instead provide a containerised flavour that could be installed in the OS of your choice. However, it will be still some time until this becomes a reality, as we are currently preparing the Expedition 2.0

dgildelaig · ‎09-01-2020

The common aspect for an issue related to RE is that it either work or fail for all the selected rules. You mention that the process completes for some rules, while some. others fail and it stays in pending locked, therefore I would suggest to check the processing logs and see if we have some information there that can help us in the investigation. The logs are in /tmp/error_SecRulesEnrich

dgildelaig · ‎08-20-2020

That's correct. Expedition does not build rules based on traffic other than from a PANOS device, and via the traffic logs. Regarding how to install Expedition in a Windows 10, I would say that the simplest option would be to run the current Expedition on a VMWare player.

dgildelaig · ‎08-18-2020

Instead of using the Legacy VM, I would suggest creating a VM with Ubuntu 16.04 and using the installer. In the main page of this Live Community Site you will find a video showing how to perform the installation

dgildelaig · ‎08-18-2020

This is because the repository where the installed is located changed between those versions. There is a post in the live community explaining how to update your repository, but I could even better advise you to install a new Expedition VM if you do not have projects that you should maintain and keep working on.

dgildelaig · ‎08-11-2020

We are not the developers of the BPA, but we consume the results that the BPA team has implemented and do the mapping for some specific check remediations. You may want to address to them via their Live space: https://live.paloaltonetworks.com/t5/best-practice-assessment/ct-p/Best_Practice_Assessment

dgildelaig · ‎08-11-2020

We may be applying the autozone on the first policy (which may be in your case the Application Layer), and missing your Security policy. We will take a look into it

dgildelaig · ‎08-11-2020

This is not actually possible. The BPA checks are performed as a single pack, and the results are also presented as a group. We have not implemented any process to disable specific checks as the results are mean to provide visibility on aspects that are not following the recommended Palo Alto Networks settings, therefore called Best Practices.

dgildelaig · ‎08-11-2020

The importing & conversion process leaves some logs in the /tmp/error file. Could you check if this file shows messages that can help identifying the source of the issue? If the information in there seems sensitive, please attach that file in the TAC case as well.

dgildelaig · ‎08-05-2020

So, it is not stuck, but it is still calculating. Think that we would have to identify involved NATs for all address objects in a security rule and calcualte, based on the routing table, the interfaces that would be involved and the zones that would be hit. So, this calculation takes a while and in your case, it is still ongoing.

dgildelaig · ‎08-05-2020

While being stuck, check if you got any error in the file /tmp/error via CLI. Also you could check via the top command if the mysql or PHP processes are consuming CPU. Calculating routes for the zones can be consuming depending on the policy you have. Obviously, if there is no route information, the calculations are faster but may not be good as information would be missing.

dgildelaig · ‎08-04-2020

We are looking into it, as making the payload smaller works. You may want to open a case with Panorama as well so they can check if this is a limitation on there while we look into Expedition end.

dgildelaig · ‎07-27-2020

Please, contact us to fwmigrate@paloaltonetworks.com to coordinate a session in which we will show you the steps to execute, mainly: - process the logs from the NGFW and not from the Panorama device.

dgildelaig · ‎07-24-2020

Under the Panorama Devices tab in the Panorama, you can click on "Retrieve connected devices". This will create all the devices separately for you. Within them, you will see that they inherit the settings for ML from their Panorama, so you only need to check the auto-process checkbox.

dgildelaig · ‎07-24-2020

My guess is that not all the address objects got transformed. Probably you had pagination and you selected to transform just a subset of all the address objects. Therefore, all the rest are still address objects and referenced as such in the policy

dgildelaig · ‎07-20-2020

The process button is not available because you are trying to click the button within a Panorama device. You can only click that button if you ara within a FW device in Expedition

dgildelaig · ‎07-20-2020

You are within a Panorama device. To be able to process the files, you need to specify it from the FW devices. Notice that you can set up the auto-process so you do not need to get into the devices in the future for processing CSV log files

dgildelaig · ‎07-16-2020

For your goal, it is easier to convert those address objects to IP objects. You can find that functionality using the right-click contextual menu that shows on the address objects

dgildelaig · ‎07-14-2020

No, unfortunately you will have to define the users that have access to Expedition and provide them roles to Expedition management and the different projects and devices.

dgildelaig · ‎07-14-2020

Could you check that: service apache2 status is running service mysql status is running service rabbitmq-service status is running netstat -pnuat shows that ports 3306, 443, 5672 are open and LISTENing and not specificaly bound to a local IP (own Expedition IP) df -h does not show a unit that uses already 100% of the space ls /var/www/html shows that the folder contains subfolders such as "bin", "console", "libs", "OS", "userManager"

dgildelaig · ‎07-10-2020

Hi @draynal , the option 2 is already present in Expedition 1.1.x. Just right click on all the objects and set merge by "name and value" or by name, or the option you find required. It will calculate even if the resulting merged object should be moved to a higher DG so it offers visibility to all the beneath DGs where the merged objects were in use. Regarding option 3, we already offer support with Splunk, but we have not initiated support for ELK. We will have to check in the future our plans to include more options

dgildelaig · ‎06-30-2020

It comes with a default set of settings that work fine with most cases. If you require extra space for logs (in case you are going to do traffic log analytics) you may want to add another drive (preferably a SSD) and some extra RAM and CPUs if possible. If you are going to import large files, check for the modification of the php.ini file (you can find this info in the forum). Also, you can check and modify the Max time and Max RAM used for Parser processing via the Web UI in the Settings->Custom Parameters section.

dgildelaig · ‎06-30-2020

It is also ready for the next release 1.1.72

dgildelaig · ‎06-30-2020

Thanks for the info and the example. I will try to correct it for the next release as well

dgildelaig · ‎06-30-2020

Hi Philip, This has been corrected for the next release 1.1.72. I will release it in the coming one or two days

Date Registered	‎11-02-2015 03:48 AM
Date Last Visited	2 weeks ago
Total Messages Posted	468
Total Likes Received	71

Online Status	Offline
Date Last Visited	2 weeks ago

Strata

Prisma

Cortex

About dgildelaig