Reports and Logging. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright Palo Alto Networks

Transcription

1 Reports and Logging Palo Alto Networks PAN-OS Administrator s Guide Version 6.0

2 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA About this Guide This guide provides the concepts and solutions to help you get the most out of your Palo Alto Networks next-generation firewalls. For additional information, refer to the following resources: For start-to-finish instruction on how to set up a new firewall, refer to the Palo Alto Networks Getting Started Guide. For information on the additional capabilities and for instructions on configuring the features on the firewall, refer to For access to the knowledge base, discussion forums, and videos, refer to For contacting support, for information on the support programs, or to manage your account or devices, refer to For the latest release notes, go to the software downloads page at To provide feedback on the documentation, please write to us at: documentation@paloaltonetworks.com. Palo Alto Networks, Inc Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at All other marks mentioned herein may be trademarks of their respective companies. Revision Date: August 21, PAN-OS 6.0 Administrator s Guide Palo Alto Networks

3 Reports and Logging The firewall provides reports and logs that are useful for monitoring activity on your network. You can monitor the logs and filter the information to generate reports with predefined or customized views. You can for example, use the predefined templates to generate reports on a user s activity or analyze the reports and logs to interpret unusual behavior on your network and generate a custom report on the traffic pattern. The following topics describe how to view, manage, customize, and generate the reports and logs on the firewall: Use the Dashboard Use the Application Command Center Use App-Scope Take Packet Captures Monitor the Firewall Forward Logs to External Services Monitor the Firewall Using SNMP Manage Reporting Identify Firewall Interfaces in External Monitoring Systems Manage Reporting Syslog Field Descriptions Palo Alto Networks PAN-OS 6.0 Administrator s Guide 157

4 Use the Dashboard Reports and Logging Use the Dashboard The Dashboard tab widgets show general device information, such as the software version, the operational status of each interface, resource utilization, and up to 10 of the most recent entries in the threat, configuration, and system logs. All of the available widgets are displayed by default, but each administrator can remove and add individual widgets, as needed. Click the refresh icon to update the Dashboard or an individual widget. To change the automatic refresh interval, select an interval from the drop-down (1 min, 2 mins, 5 mins, or Manual). To add a widget to the Dashboard, click the widget drop-down, select a category and then the widget name. To delete a widget, click in the title bar. The following table describes the Dashboard widgets. Dashboard Charts Top Applications Top High Risk Applications General Information Interface Status Threat Logs Config Logs Data Filtering Logs URL Filtering Logs System Logs System Resources Logged In Admins ACC Risk Factor Descriptions Displays the applications with the most sessions. The block size indicates the relative number of sessions (mouse-over the block to view the number), and the color indicates the security risk from green (lowest) to red (highest). Click an application to view its application profile. Similar to Top Applications, except that it displays the highest-risk applications with the most sessions. Displays the device name, model, PAN-OS software version, the application, threat, and URL filtering definition versions, the current date and time, and the length of time since the last restart. Indicates whether each interface is up (green), down (red), or in an unknown state (gray). Displays the threat ID, application, and date and time for the last 10 entries in the Threat log. The threat ID is a malware description or URL that violates the URL filtering profile. Displays the administrator username, client (Web or CLI), and date and time for the last 10 entries in the Configuration log. Displays the description and date and time for the last 60 minutes in the Data Filtering log. Displays the description and date and time for the last 60 minutes in the URL Filtering log. Displays the description and date and time for the last 10 entries in the System log. A Config installed entry indicates configuration changes were committed successfully. Displays the Management CPU usage, Data Plane usage, and the Session Count, which displays the number of sessions established through the firewall. Displays the source IP address, session type (Web or CLI), and session start time for each administrator who is currently logged in. Displays the average risk factor (1 to 5) for the network traffic processed over the past week. Higher values indicate higher risk. 158 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

5 Reports and Logging Use the Dashboard Dashboard Charts High Availability Locks Descriptions If high availability (HA) is enabled, indicates the HA status of the local and peer device green (active), yellow (passive), or black (other). For more information about HA, see High Availability. Shows configuration locks taken by administrators. Palo Alto Networks PAN-OS 6.0 Administrator s Guide 159

6 Use the Application Command Center Reports and Logging Use the Application Command Center The ACC tab visually depicts trends and historic view of traffic on your network. ACC Risk Level ACC Charts ACC Detail Pages Use the ACC 160 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

7 Reports and Logging Use the Application Command Center ACC Risk Level The ACC tab displays the overall risk level for all network traffic, the risk levels and number of threats detected for the most active and highest-risk applications on your network, and the number of threats detected from the busiest application categories and from all applications at each risk level. Use the ACC to view application data for the past hour, day, week, month, or any custom-defined time frame. Risk levels (1=lowest to 5=highest) indicate the application s relative security risk based on criteria such as whether the application can share files, is prone to misuse, or tries to evade firewalls. Palo Alto Networks PAN-OS 6.0 Administrator s Guide 161

8 Use the Application Command Center Reports and Logging ACC Charts There are five charts displayed on the Application Command Center (ACC) tab: Application URL Filtering Threat Prevention Data Filtering HIP Matches The following table describes the charts displayed on the ACC tab: ACC Chart Application URL Filtering Threat Prevention Description Displays application information grouped by the following attributes: Applications High risk applications Categories Sub Categories Technology Risk Each chart can include the number of sessions, bytes transmitted and received, number of threats, application category, application subcategories, application technology, and risk level, as applicable. Displays URL/category information grouped by the following attributes: URL Categories URLs Blocked URL Categories Blocked URLs Each chart can include the URL, URL category, repeat count (number of times access was attempted, as applicable). Displays threat information grouped by the following attributes: Threats Types Spyware Spyware Phone Home Spyware Downloads Vulnerability Virus Each chart can include the threat ID, count (number of occurrences), number of sessions, and subtype (such as vulnerability), as applicable 162 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

9 Reports and Logging Use the Application Command Center ACC Chart Data Filtering HIP Matches Description Displays information on data filtered by the firewall grouped by the following attributes: Content/File Types Types File Names Displays the host information collected by the firewall grouped by: HIP Objects HIP Profiles Palo Alto Networks PAN-OS 6.0 Administrator s Guide 163

10 Use the Application Command Center Reports and Logging ACC Detail Pages To view additional details, click any of the links on the ACC charts. A details page opens to show information about the item at the top and additional lists for related items. For example, click on the web-browsing link on the Application chart opens the Application Information page for web-browsing: 164 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

11 Reports and Logging Use the Application Command Center Use the ACC The following procedure describes how to use the ACC tab and how to customize your view: Use the ACC Step 1 Step 2 On the ACC, change one or more of the settings at the top of the page. Use the drop-down to select Applications, URL Categories, Threats, Content/File Types, and HIP Objects to view. Select a virtual system, if virtual systems are defined. Select a time period from the Time drop-down. The default is Last Hour. Select a sorting method from the Sort By drop-down. You can sort the charts in descending order by number of sessions, bytes, or threats. The default is by number of sessions. For the selected sorting method, select the top number of applications and application categories shown in each chart from the Top drop-down. Click the submit icon to apply the selected settings. To open log pages associated with the information on the page, use the log links in the upper-right corner of the page, as shown here. The context for the logs matches the information on the page. Step 3 To filter the list, click an item in one of the columns, this will add that item to the filter bar located above the log column names. After adding the desired filters, click the Apply Filter icon. Palo Alto Networks PAN-OS 6.0 Administrator s Guide 165

12 Use App-Scope Reports and Logging Use App-Scope The App-Scope reports provide visibility and analysis tools to help pinpoint problematic behavior, helping you understand changes in application usage and user activity, users and applications that take up most of the network bandwidth, and identify network threats. With the App-Scope reports, you can quickly see if any behavior is unusual or unexpected. Each report provides a dynamic, user-customizable window into the network; hovering the mouse over and clicking either the lines or bars on the charts opens detailed information about the specific application, application category, user, or source on the ACC. The following App-Scope reports are available: Summary Report Change Monitor Report Threat Monitor Report Threat Map Report Network Monitor Report Traffic Map Report 166 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

13 Reports and Logging Use App-Scope Summary Report The App-Scope Summary report displays charts for the top five gainers, losers, and bandwidth consuming applications, application categories, users, and sources. Palo Alto Networks PAN-OS 6.0 Administrator s Guide 167

14 Use App-Scope Reports and Logging Change Monitor Report The App-Scope Change Monitor report displays changes over a specified time period. For example, the following chart displays the top applications that gained in use over the last hour as compared with the last 24-hour period. The top applications are determined by session count and sorted by percent. The Change Monitor Report contains the following buttons and options. Button Description Determines the number of records with the highest measurement included in the chart. Determines the type of item reported: Application, Application Category, Source, or Destination. Displays measurements of items that have increased over the measured period. Displays measurements of items that have decreased over the measured period. Displays measurements of items that were added over the measured period. Displays measurements of items that were discontinued over the measured period. Applies a filter to display only the selected item. None displays all entries. 168 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

15 Reports and Logging Use App-Scope Button Description Determines whether to display session or byte information. Determines whether to sort entries by percentage or raw growth. Specifies the period over which the change measurements are taken. Palo Alto Networks PAN-OS 6.0 Administrator s Guide 169

16 Use App-Scope Reports and Logging Threat Monitor Report The App-Scope Threat Monitor report displays a count of the top threats over the selected time period. For example, the following figure shows the top 10 threat types over the last 6 hours. Each threat type is color-coded as indicated in the legend below the chart. The Threat Monitor report contains the following buttons and options. Button Description Determines the number of records with the highest measurement included in the chart. Determines the type of item measured: Threat, Threat Category, Source, or Destination. Applies a filter to display only the selected type of items. Determines whether the information is presented in a stacked column chart or a stacked area chart. Specifies the period over which the measurements are taken. 170 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

17 Reports and Logging Use App-Scope Threat Map Report The App-Scope Threat Map report shows a geographical view of threats, including severity. Each threat type is color-coded as indicated in the legend below the chart. Click a country on the map to zoom in. Click the Zoom Out button in the lower right corner of the screen to zoom out. The Threat Map report contains the following buttons and options. Button Description Determines the number of records with the highest measurement included in the chart. Displays incoming threats. Displays outgoing threats. Applies a filter to display only the selected type of items. Indicates the period over which the measurements are taken. Palo Alto Networks PAN-OS 6.0 Administrator s Guide 171

18 Use App-Scope Reports and Logging Network Monitor Report The App-Scope Network Monitor report displays the bandwidth dedicated to different network functions over the specified period of time. Each network function is color-coded as indicated in the legend below the chart. For example, the image below shows application bandwidth for the past 7 days based on session information. The Network Monitor report contains the following buttons and options. Button Description Determines the number of records with the highest measurement included in the chart. Determines the type of item reported: Application, Application Category, Source, or Destination. Applies a filter to display only the selected item. None displays all entries. Determines whether to display session or byte information. Determines whether the information is presented in a stacked column chart or a stacked area chart. Indicates the period over which the change measurements are taken. 172 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

19 Reports and Logging Use App-Scope Traffic Map Report The App-Scope Traffic Map report shows a geographical view of traffic flows according to sessions or flows. Each traffic type is color-coded as indicated in the legend below the chart. The Traffic Map report contains the following buttons and options. Buttons Description Determines the number of records with the highest measurement included in the chart. Displays incoming threats. Displays outgoing threats. Determines whether to display session or byte information. Indicates the period over which the change measurements are taken. Palo Alto Networks PAN-OS 6.0 Administrator s Guide 173

20 Take Packet Captures Reports and Logging Take Packet Captures PAN-OS supports packet capture for troubleshooting or detecting unknown applications. You can define filters such that only the packets that match the filters are captured. The packet captures are locally stored on the device and are available for download to your local computer. Packet Capture is for troubleshooting only. This feature can cause the system performance to degrade and should be used only when necessary. Remember to disable the feature after you complete the packet capture. The following table describes the packet capture settings on Monitor > Packet Capture. Field Description Configure Filtering Manage Filters Filtering Pre-Parse Match Click Manage Filters, click Add to add a new filter, and specify the following information: Id Enter or select an identifier for the filter. Ingress Interface Select the firewall interface. Source Specify the source IP address. Destination Specify the destination IP address. Src Port Specify the source port. Dest Port Specify the destination port. Proto Specify the protocol to filter. Non-IP Choose how to treat non-ip traffic (exclude all IP traffic, include all IP traffic, include only IP traffic, or do not include an IP filter). IPv6 Select the check box to include IPv6 packets in the filter. Click to toggle the filtering selections on or off. Click to toggle the pre-parse match option on or off. The pre-parse-match option is added for advanced troubleshooting purposes. After a packet enters the ingress port, it proceeds through several processing steps before it is parsed for matches against pre-configured filters. It is possible for a packet, due to a failure, to not reach the filtering stage. This can occur, for example, if a route lookup fails. Set the pre-parse-match setting to ON to emulate a positive match for every packet entering the system. This allows the firewall to capture even the packets that do not reach the filtering process. If a packet is able to reach the filtering stage, it is then processed according to the filter configuration and discarded if it fails to meet filtering criteria. 174 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

21 Reports and Logging Take Packet Captures Field Description Configure Capturing Packet Capture Click to toggle packet capturing on or off. For anti-spyware and vulnerability protection profiles, you can enable extended packet captures for rules and exceptions defined in the profile. This functionality allows the firewall to capture from 1 to 50 packets and provides more context when analyzing the threat logs. To define the extended packet capture length: 1. Select Device > Setup > Content-ID. 2. Edit the Threat Detection Settings section to specify the Capture Length for the number of packets to capture. 3. View the packet capture in Monitor > Logs > Threat. Locate the threat log entry and click the green arrow (Packet Capture) icon in the corresponding row to view the capture. Packet Capture Stage Select Add and specify the following: Stage Indicate the point at which to capture the packet: drop When packet processing encounters an error and the packet is to be dropped. firewall When the packet has a session match or a first packet with a session is successfully created. receive When the packet is received on the dataplane processor. transmit When the packet is to be transmitted on the dataplane processor. File Specify the capture file name. The file name should begin with a letter and can include letters, digits, periods, underscores, or hyphens. Packet Count Specify the number of packets after which capturing stops. Byte Count Specify the number of bytes after which capturing stops. Captured Files Captured Files Select Delete to remove a packet capture file from the list displaying captured files. Settings Clear All Settings Select Clear All Settings to clear all packet capture settings. Palo Alto Networks PAN-OS 6.0 Administrator s Guide 175

22 Monitor the Firewall Reports and Logging Monitor the Firewall The following sections describe the methods you can use to monitor the firewall and provide basic setup instructions: Monitor Applications and Threats Monitor Log Data Monitor the Dashboard View Reports You can also configure the firewall (excluding PA-4000 Series and PA-7050 firewalls) to export flow data to a NetFlow collector for analysis and reporting. To configure NetFlow Settings, refer to the PAN-OS-6.0 Web Interface Reference Guide. 176 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

23 Reports and Logging Monitor the Firewall Monitor Applications and Threats All Palo Alto Networks next-generation firewalls come equipped with the App-ID technology, which identifies the applications traversing your network, irrespective of protocol, encryption, or evasive tactic. You can then Use the Application Command Center to monitor the applications. ACC graphically summarizes the log database to highlight the applications traversing your network, who is using them, and their potential security impact. ACC is dynamically updated, using the continuous traffic classification that App-ID performs; if an application changes ports or behavior, App-ID continues to see the traffic, displaying the results in ACC. You can quickly investigate new, risky, or unfamiliar applications that appear in ACC with a single click that displays a description of the application, its key features, its behavioral characteristics, and who is using it. Additional visibility into URL categories, threats, and data provides a complete and well-rounded picture of network activity. With ACC, you can very quickly learn more about the traffic traversing the network and then translate that information into a more informed security policy. Palo Alto Networks PAN-OS 6.0 Administrator s Guide 177

24 Monitor the Firewall Reports and Logging Monitor Log Data All Palo Alto Networks next-generation firewalls can generate log files that provide an audit trail of the activities and events on the firewall. There are separate logs for separate types of activities and events. For example, the Threat logs record all traffic that causes the firewall to generate a security alarm, whereas URL Filtering logs record all traffic that matches a URL Filtering profile attached to a security policy, and Config logs record all changes to the firewall configuration. You can either Forward Logs to External Services or you can view logs locally on the device as follows: View the Log Files Filter Log Data View the Log Files The firewall maintains logs for WildFire, configurations, system, alarms, traffic flows, threats, URL filtering, data filtering, and Host Information Profile (HIP) matches. You can view the current logs at any time. To locate specific entries, you can apply filters to most of the log fields. The firewall displays the information in logs so that role-based administration permissions are respected. When you display logs, only the information that you have permission to see is included. For information on administrator permissions, see Administrative Roles. By default all log files are generated and stored locally on the firewall. You can view these log files directly (Monitor > Logs): To display additional details, click the spyglass icon for an entry. 178 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

25 Reports and Logging Monitor the Firewall The following table includes information on each log type: Log Description Charts Traffic Description Displays an entry for the start and end of each session. Each entry includes the date and time, the source and destination zones, addresses, and ports, the application name, the security rule name applied to the flow, the rule action (allow, deny, or drop), the ingress and egress interface, and the number of bytes. Click next to an entry to view additional details about the session, such as whether an ICMP entry aggregates multiple sessions between the same source and destination (the Count value will be greater than one). The Type column indicates whether the entry is for the start or end of the session, or whether the session was denied or dropped. A drop indicates that the security rule that blocked the traffic specified any application, while a deny indicates the rule identified a specific application. If traffic is dropped before the application is identified, such as when a rule drops all traffic for a specific service, the application is shown as not-applicable. Palo Alto Networks PAN-OS 6.0 Administrator s Guide 179

26 Monitor the Firewall Reports and Logging Log Description Charts Threat URL Filtering WildFire Submissions Data Filtering Configuration System HIP Match Description Displays an entry when traffic matches a Security Profile (Antivirus, Anti-spyware, Vulnerability, URL Filtering, File Blocking, Data Filtering, or DoS Protection) that is attached to a security policy on the firewall. Each entry includes the date and time, a threat name or URL, the source and destination zones, addresses, and ports, the application name, and the alarm action (allow or block) and severity. Click next to an entry to view additional details about the threat, such as whether the entry aggregates multiple threats of the same type between the same source and destination (the Count value will be greater than one). The Type column indicates the type of threat, such as virus or spyware. The Name column is the threat description or URL, and the Category column is the threat category (such as keylogger ) or URL category. If local packet captures are enabled, click next to an entry to access the captured packets. To enable local packet captures, see Take Packet Captures. Displays logs for all traffic that matches a URL Filtering profile attached to a security policy. For example, if policy blocks access to specific web sites and web site categories or if policy is configured to generate an alert when a web site is accessed. For information on defining URL filtering profiles, see URL Filtering. Displays logs for files that are uploaded and analyzed by the WildFire cloud, log data is sent back to the device after analysis, along with the analysis results. Displays logs for the security policies that help prevent sensitive information such as credit card or social security numbers from leaving the area protected by the firewall. See Set Up Data Filtering for information on defining data filtering profiles. This log also shows information for file blocking profiles. For example, if you are blocking.exe files, the log will show the files that were blocked. If you forward files to WildFire, you will see the results of that action. In this case, if you are forwarding PE files to WildFire, for example, the log will show that the file was forwarded and will also show the status on whether or not it was uploaded to WildFire successfully or not. Displays an entry for each configuration change. Each entry includes the date and time, the administrator username, the IP address from where the change was made, the type of client (XML, Web or CLI), the type of command executed, whether the command succeeded or failed, the configuration path, and the values before and after the change. Displays an entry for each system event. Each entry includes the date and time, the event severity, and an event description. Displays traffic flows that match a HIP Object or HIP Profile that you have configured. Filter Log Data Each log page has a filter area at the top of the page. Use the filter area as follows: 180 PAN-OS 6.0 Administrator s Guide Palo Alto Networks

27 Reports and Logging Monitor the Firewall Click any of the underlined links in the log listing to add that item as a log filter option. For example, if you click the Host link in the log entry for and Web Browsing in both items are added, and the search will find entries that match both (AND search). To define other search criteria, click Add Log Filter. Select the type of search (and/or), the attribute to include in the search, the matching operator, and the values for the match, if appropriate. Click Add to add the criterion to the filter area on the log page, and then click Close to close the pop-up window. Click Apply Filter to display the filtered list. You can combine filter expressions added on the log page with those that you define in the Expression pop-up window. Each is added as an entry on the Filter line on the log page. If you set the in Received Time filter to Last 60 seconds, some of the page links on the log viewer may not show results because the number of pages may grow or shrink due to the dynamic nature of the selected time. To clear filters and redisplay the unfiltered list, click Clear Filter. To save your selections as a new filter, click Save Filter, enter a name for the filter, and click OK. To export the current log listing (as shown on the page, including any applied filters) click Save Filter. Select whether to open the file or save it to disk, and select the check box if you want to always use the same option. Click OK. To export the current log listing in CSV Format, select the Export to CSV icon. By default, exporting the log listing to CSV format generates a CSV report with up to 2,000 rows of logs. To change the limit for rows displayed in CSV reports, use the Max Rows in CSV Export field on the Log Export and Reporting subtab (select Device > Setup > Management > Logging and Reporting Settings). To change the automatic refresh interval, select an interval from the drop-down list (1 min, 30 seconds, 10 seconds, or Manual). To change the number of log entries per page, select the number of rows from the Rows drop-down. Log entries are retrieved in blocks of 10 pages. Use the paging controls at the bottom of the page to navigate through the log list. Select the Resolve Hostname check box to begin resolving external IP addresses to domain names. Palo Alto Networks PAN-OS 6.0 Administrator s Guide 181