About ash83

Hi Community,   This query is for PAN-OS v8.1.X   I am trying to generate an email alert when the firewall sees an (action eq sinkhole) event or when the security policy created to sinkhole an infected host is used. Email Profile(s) have already configured and so has Sinkhole.   What is the best way to configure both, the email alert for the (action eq sinkhole) or any other Log-Threat entry, and also, when a specific security policy is used?   Lastly, is it possible to generate a dynamic object including source IPs that have already been blocked by the firewall after detecting a vulnerability? The idea is to block access to IPs that already attempted an attack and were blocked by the firewall in the past.   panw-highrisk-ip-list and panw-known-ip-list do not seem to be very effective as only one IP: 80.211.52.246 has been detected in almost 5 days.   Thanks. Ho   ... View more

Have 2 HA VMs with 9.0.1   Following this article: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/threat-prevention/use-dns-queries-to-identify-infected-hosts-on-the-network/identify-infected-hosts.html   In section 3), how does this need to be configured ( ( addr.dst in 10.15.0.20 ) ) when using Palo Alto Networks Sinkhole IP (sinkhole.paloaltonetworks.com) ?   Thanks. Ho ... View more

We are following Expedition-LogAnalysisGuide_v1.0.2.pdf to start using ML   Expedition is v1.1.12, BP v3.6.3, Task Manager is running and there are no internal checks to remediate The firewalls are VMs running 9.0.1 In page 6 in the above doc, IP address 192.168.44.131 is used for Expedition. However, in page 7, a different IP is used in section Hostname: 10.30.11.50 Please confirm if the IP to configure in Schedule Log Report-Hostname should be the IP for Expedition. We worked under this assumption, but we get the following error when clicking on Test SCP server connection: Error response from server: bash: /home/expedition/logs/ssh-export-test.txt: No such file or directory What is causing this error and how can it be fixed? Until the above is sorted, we would like to upload the logs manually, but the pdf does not include instructions on how to accomplish this: MANUALLY EXPORT LOGS FROM MONITOR You can always go to any firewall from Palo Alto Networks and from the Monitor tab export the logs in CSV format and upload that CSV file to Expedition for processing. What is the process to manually upload the firewall logs onto Expedition? Thanks. Ho ... View more