To truly appreciate the capability of this box i would recommend logging and alerting everything then tune out false positive or severity . Below is based on 6.0 but 6.1 has some additional http fields it can log. easiest thing to do is use the gui to do a filter then write it down but its pretty simple once you get it going and replace the eq with a contains or neq for negate (you could also put a ! to negate the filter) geq greater than or equal , leq less than or equal , (neq "") or (contains"") for is present . You could also start with the ACC then move to the traffic logs once filters are setup. Each log (traffic, threat,url,datafilter etc..) can have their specfic syntax . Also the syntax may overlap with the custom reports but not always. The syntax also doesnt' match doesnt' match up 100% with the traffic filters. from traffic logs its : category-of-app eq media for example from a custom report to filter app category of media syntax is : category-of-name eq media same with sub categories subcategory-of-app eq photo-video in traffic logs , subcategory-of-name eq photo-video in custom reports The two mentioned also aren't available as a selectable attribute in the Add log filter gui You can also enter some attributes that are NOT available in the dropdown Some interesting filter examples in the traffic log 1. photo-video downloads greater than 100mb subcategory-of-app eq photo-video and bytes_received geg 100000000 2. bytes sent greater than 1mb to destination country no US bytes_sent geg 1000000 and dstloc neq US 3. filter for app category of media application NOT rtmp category-of-app eq media and app neq rtmp You can also nest multiple search terms 4. Any ip of from subnet 192.168.0.0/16 in source or dest , application is ssl and dest port is NOT 443 addr in 192.168.0.0/16 and app eq ssl and port.dst neq 443 5. looking for destination port 80 or 8080 that is not application web-browsing ((port.dst eq 80) or (port.dst eq 8080)) and app neq web-browsing Some interesting filter examples in the threat log If a device is managed by panorama there is a field 'URL' that shows up but this is actually additional info such as a file etc.. in the custom report the attribute value is 'misc' . Even if a device is not managed by the firewall you can filter for misc . In a detailed log view under 'threat detail' you'll also see the option of URL . In panorama you can simply look at the URL field in the threat logs 1. To see if a medium severity or higher threat has any value for url / misc severity geq medium and misc neq "" 2. Virus that matches smtp subtype eq virus and app eq smtp 3. threats that are not a virus that contains a .doc or .docx file name (only the data filtering logs lets you filter by file type / threatid for a file so searching by file ext could provide some useful data) !(subtype eq virus) and ((misc contains .doc) or (misc contains .docx)) Some interesting filter examples in the URL log 1. find a url that partially matches vpn. url contains vpn. 2. category malware and application ssl or port 443 category eq malware and ((app eq ssl) or (port.dst.eq 443)) Now for some interesting filter examples in the Data Filtering 1. Findout if people are downloading pirated movie / tv shows via http . filename that contains hdtv (commonly used for illegal ripped hdtv shows), threatid eq 52104 (threat id to match file type mp4) More info http://en.wikipedia.org/wiki/Pirated_movie_release_types filename contains hdtv and threatid eq 52104 2. All file types PE that were not part of a software update category subcategory-of-app neq software-update and threatid eq 52060
... View more
