Palo Alto Network Firewall Analytics¶

LP_PaloAlto:User Activities¶

This dashboard consists of the following widgets:

LP_PaloAlto:File Activities¶

This dashboard consists of the following widgets:

LP_PaloAlto:Firewall¶

This dashboard consists of the following widgets:

LP_PaloAlto:Config Overview¶

This dashboard consists of the following widgets:

LP_PaloAlto: General¶

This dashboard consists of the following widgets:

LP_PaloAlto:Content Overview¶

This dashboard consists of the following widgets:

LP_PaloAlto:Threats¶

This dashboard consists of the following widgets:

LP_PaloAlto:Traffic¶

This dashboard consists of the following widgets:

LP_PaloAlto: System Overview¶

This dashboard consists of the following widgets:

LP_PaloAltoNetworkFirewall¶

Available labels are:

Generating Palo Alto Network Firewall Report Templates¶

1. Go to Report >> Reports Template.

2. Select VENDOR REPORT TEMPLATES from the drop-down.

3. Click the Use Vendor Report from Actions of the required template.

Using the Palo Alto Network Firewall Report Template¶

4. Click the Run This Report from Actions.

Running the the Palo Alto Network Firewall Report Template¶

5. Select Repos, Time Zone, Time Range, Export Type and enter Email.

6. Click Submit.

Report Options¶

Go to Report Jobs to view the generating reports. Go to Inbox, to view the generated reports and click PDF from Download to download the generated report.

Downloading a report¶

LP_PaloAlto Multiple Failed Login¶

• Trigger Condition: Multiple failed login attempts are detected.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: -

• Query:

  [5 norm_id=PaloAltoNetworkFirewall label=User label=Authentication label=fail label=System having same user within 1 minutes]
  

LP_PaloAlto Session Drop¶

• Trigger Condition: The firewall drops the session before or after the application is identified.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: -

• Query:

  norm_id=PaloAltoNetworkFirewall label=Traffic (sub_category=drop or sub_category=deny)
  

LP_PaloAlto Potential Risk Activity¶

• Trigger Condition: Malicious URL categories like Grayware, Hacking, Parked and Phishing are detected.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: -

• Query:

  norm_id = PaloAltoNetworkFirewall label = Traffic category in ['Grayware','Hacking','Parked','Phishing']
  

LP_PaloAlto Risk Events Allowed¶

• Trigger Condition: The firewall allowed the events or actions of medium, high or critical risk.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: -

• Query:

  norm_id=PaloAltoNetworkFirewall label=Threat action=allow log_level in ['medium','high','critical']
  

LP_PaloAlto Potential C2 Connection¶

• Trigger Condition: Command and Control URLs or domains dynamically assigns IP addresses or newly registered domain sites are visited, which are often used to deliver malware payloads for C2 traffic, malicious commands, or exfiltrate data.

• ATT&CK Category: Command And Control

• ATT&CK Tag: Dynamic Resolution

• ATT&CK ID: T1568

• Minimum Log Source Requirement: -

• Query:

  norm_id = PaloAltoNetworkFirewall label = Traffic category in ['Command and Control','Dynamic DNS','Malware','Newly Registered Domain']
  

LP_PaloAlto Illegal Content Download¶

• Trigger Condition: The download of any illegal content like content that allows illegal download of software or other intellectual property, which poses a potential liability risk is detected.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: -

• Query:

  norm_id = PaloAltoNetworkFirewall label = Traffic category='Copyright Infringement'
  

LP_PaloAlto HTTP Request Block¶

• Trigger Condition: The firewall blocked access to a website, allows a user to access the blocked content by clicking continue, or allows a user to access the blocked page after entering the password, also known as block override.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: -

• Query:

  norm_id = PaloAltoNetworkFirewall label=Threat label=Url action in ['block-continue','block-override']
  

LP_PaloAlto Flooding Packet Drop¶

• Trigger Condition: Connection per second (CPS) activates the flood protection mechanism and begins dropping new connections. The firewall gauges the amount of flood type entering the zone in the new CPS and compares the total to the thresholds you had configured.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: -

• Query:

  norm_id = PaloAltoNetworkFirewall label=Threat action="random-drop"
  

LP_PaloAlto DNS SinkHole Activate¶

• Trigger Condition: DNS Sinkholing is activated in the firewall. DNS Sinkholing helps to rectify the infected hosts on a protected network using DNS traffic when the firewall cannot see the infected client’s DNS query. In other words, the firewall cannot see the originator of the DNS query.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: -

• Query:

  norm_id = PaloAltoNetworkFirewall label=Threat action="sinkhole"
  

LP_PaloAlto Cortex Risk Events Unrestricted¶

• Trigger Condition: Cortex XDR agent terminates an executable file with malware, phishing, or malware is not restricted by termination or blocking verdict.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: -

• Query:

  norm_id = PaloAltoNetworkFirewall verdict in ['1','2','3'] block=0 terminate=0
  

LP_PaloAlto Bypass Content Filter¶

• Trigger Condition: The firewall collects information on traffic coming from URLs or any services used to bypass the content filtering product for threat prevention.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: -

• Query:

  norm_id = PaloAltoNetworkFirewall label = Traffic category="Proxy Avoidance and Anonymizers"
  

LP_PaloAlto Brute Force on Block Override¶

• Trigger Condition: Brute force attacks on URLs or domains are perfomed in an override list are detected.

• ATT&CK Category: Credential Access

• ATT&CK Tag: Brute Force

• ATT&CK ID: T1110

• Minimum Log Source Requirement: -

• Query:

  norm_id = PaloAltoNetworkFirewall label=Threat label=Url action="override-lockout"
  

LP_PaloAlto Brute Force Attempts¶

• Trigger Condition: Any brute force signature is detected. You can learn more about brute force signature and their trigger conditions from Palo Alto Network Firewall’s website.

• ATT&CK Category: Credential Access

• ATT&CK Tag: Brute Force

• ATT&CK ID: T1110

• Minimum Log Source Requirement: -

• Query:

  norm_id = PaloAltoNetworkFirewall label = Threat threat_id IN PALOALTO_BRUTE_FORCE_THREAT_ID