Үндсэн агуулга руу алгасах

Cookie

Сайтаа сайжруулж, танд тохирох хямдрал, санал харуулахад тусална. Дэлгэрэнгүй

BD Systems AsiaАлбан ёсны түншBitdefender Country Partner (шинэ цонхонд)
Bitdefender

Palo Alto 11.x content pack (контент багц)

Bitdefender-ийн албан ёсны баримтаас орчуулавАнгли эх (EN) · Орчуулсан: 2026.11.12

← Контент багцууд

Palo Alto 11.x content pack (контент багц)

Palo Alto нь вирус, spyware, өгөгдөл алдагдал, аппликейшний эмзэг байдал зэрэг хортой халдлагаас хэрэглэгчдийг хамгаалахын тулд бодит цагийн (line-rate, бага сааталтай) контент скан хийдэг дараагийн үеийн галт хана (next-generation firewall) юм. Palo Alto нь stream-д суурилсан аюул урьдчилан сэргийлэх хөдөлгүүрт тулгуурладаг. Энэ технологийн багц Palo Alto логийг боловсруулж, сонирхолтой түгээмэл үйл явдлуудыг нормчилж, баяжуулна.

Дэмжигдэх хувилбарууд

  • PAN-OS 11.1+

Шаардлага

Palo Alto Networks TCP (PAN-OS v11+) input руу лог илгээдэг Palo Alto төхөөрөмж. Input үүсгэх, тохируулах талаар Palo Alto Networks Input хэсгийг үзнэ үү.

Анхаар

Palo Alto төхөөрөмжүүдийг custom формат ашиглахгүйгээр өгөгдөл илгээхээр тохируулах ёстой.

Stream-ийн тохиргоо

Энэ технологийн багц 1 stream агуулна:

  • "Illuminate:Palo Alto Messages"

Хэрэв та өмнө нь Illuminate-тай Palo Alto 9.x багцыг ашиглаж байсан бол энэ багц нэг stream-ийг ашиглана.

Тэмдэглэл

Хэрэв энэ stream багц идэвхжихээс өмнө байхгүй бол үүсгэгдэж, мессежүүдийг энэ stream болон холбогдох index set рүү чиглүүлэхээр тохируулагдана. Энэ stream-д ямар ч stream rule тохируулсан байх ёсгүй.

Index set-ийн тохиргоо

Энэ технологийн багц 1 index set тодорхойлолт агуулна:

  • "Palo Alto Logs"

Тэмдэглэл

Хэрэв энэ index set өмнө нь тодорхойлогдсон бол юу ч өөрчлөгдөхгүй. Байхгүй бол таны лицензийн эрхийн дагуу үүсгэгдэнэ.

Лог цуглуулалт

Palo Alto төхөөрөмжийн логийн тохиргоо

Төхөөрөмжөө Palo Alto logging guide-ийн зааврын дагуу тохируулж, transport-оор TCP, формат-аар BSD-г ашиглана.

Лог боловсруулалт

Palo Alto 11.x-д зориулсан Illuminate багц нь бүх Palo Alto логт нийтлэг зарим талбарыг нэрлэж өөрчилдөг боловч голчлон дараах лог төрлүүдийг боловсруулна:

  • Config
  • Decryption
  • GlobalProtect
  • HIP Match
  • System
  • Threat
  • Traffic
  • User-ID

Palo Alto лог ба CSV боловсруулалт

Illuminate нь CSV форматтай Palo Alto логийг боловсруулна. PAN-OS-ийн шинэ хувилбарууд нэмэлт талбар оруулах үед түгээмэл асуудал гардаг. Эдгээр нэмэлт талбарыг зөв зохицуулахын тулд энэ багц тэдгээрийг additional_field_ угтвартай, дараа нь талбарын байрлалд харгалзах үсэг бүхий placeholder талбаруудад хадгалдаг. Эдгээр нэмэлт баганыг илэрхийлэхэд a-аас x хүртэлх үсгийг ашиглана. Эдгээр placeholder нь түр зуурынх бөгөөд багцын ирээдүйн хувилбарт зөв нэрлэсэн талбаруудаар солигдоно.

IP талбарын боловсруулалт

Palo Alto төхөөрөмжүүд төхөөрөмжийн IPv4 болон IPv6 хаягт тусдаа талбартай байдаг. Эдгээр утгын аль нэг нь байхгүй үед харгалзах талбарт 0.0.0.0 утга бичигдэнэ. Illuminate нь IPv6 хаягийг тохирох IP талбарт (source_ip, host_ip эсвэл destination_ip) дахин оноодог.

Хэрэв IPv4 болон IPv6 хоёр утга хоёулаа тодорхойлогдсон бол (өөрөөр хэлбэл 0.0.0.0 утга оноогоогүй бол) талбарын оноолтод өөрчлөлт хийгдэхгүй.

Талбарын нормчлол

Palo Alto-д зориулсан Illuminate багц нь бүх логийн нийтлэг талбарыг нормчилдог. Дараах хүснэгтэд нормчилсон нийтлэг талбаруудыг жагсаав.

Нийтлэг талбаруудын жагсаалт

Palo Alto fieldIlluminate field
Receive Timeevent_received_time
Serial Numberevent_observer_uid
Typevendor_subtype
Threat/Content Typevendor_log_subtype
Generated Timevendor_event_created

Config logs

Лог форматын жишээ:

1,2024/10/04 03:46:00,,CONFIG,0,2816,2024/10/04 03:46:00,172.16.14.19,,commit,admin,Web,Submitted,,7421534605078953992,0x0,0,0,0,0,,PA-VM,0,,0,2024-10-04T03:46:00.050-07:00

Нормчилсон талбарууд:

Palo Alto fieldsIlluminate fields
Hosthost_ip or host_hostname
Virtual Systemhost_virtfw_id
Commanduser_command
Adminuser_name
Clientvendor_signin_protocol
Resultvendor_event_action
Configuration Pathuser_command_path
Sequence Numberevent_uid
Action Flagsvendor_log_panorama
Device Group Hierarchy Level 1vendor_dev_group_level_1
Device Group Hierarchy Level 2vendor_dev_group_level_2
Device Group Hierarchy Level 3vendor_dev_group_level_3
Device Group Hierarchy Level 4vendor_dev_group_level_4
Virtual System Namehost_virtfw_hostname
Device Nameevent_observer_hostname
Device Groupdevice_group
Audit Commentvendor_audit_comment
High Resolution Timestampevent_created

Decryption logs

Лог форматын жишээ:

1,2024/11/28 04:39:15,007954000533467,DECRYPTION,0,2817,2024/11/28 04:39:15,172.16.16.11,198.51.100.20,172.16.14.28,198.51.100.20,LAN_WAN,,,web-browsing,vsys1,LAN_Zone,WAN_Zone,ethernet1/1,ethernet1/3,Licen_PA,2024/11/28 04:39:15,593,1,49984,443,12874,443,0x1400000,tcp,allow,N/A,,,,,b8b30cde-a128-468c-a1ca-69fc9cd04b22,Finished,Finished,TLS1.2,ECDHE,AES_256_GCM,SHA384,Test SSL Decryption,secp384r1,None,trusted,Trusted,Forward,01e3ae440d35ca7bc34,d8d8858803dacbb6b9002a070297eeaf0269380972364ba09e518ebe3676fa88,2024/11/12 16:00:00,2025/05/13 16:59:59,V3,2048,14,30,23,14,:::::RSA,login.live.com,DigiCert SHA2 Secure Server CA,DigiCert Global Root CA,login.live.com,,,,,,,,,2024-11-28T04:39:15.985-08:00,,,,,,,,,,,,,,,,,7442296184930041891,0x0,0,0,0,0,,PA-VM,1,internet-utility,general-internet,browser-based,4,\"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use\",,web-browsing,no,no,

Нормчилсон талбарууд:

Palo Alto fieldsIlluminate fields
Source Addresssource_ip
Destination Addressdestination_ip
NAT Source IPsource_nat_ip
NAT Destination IPdestination_nat_ip
Rulerule_name
Source Useruser_name
Destination Userdestination_user_name
Applicationapplication_name
Virtual Systemhost_virtfw_id
Source Zonesource_zone
Destination Zonedestination_zone
Inbound Interfacenetwork_interface_in
Outbound Interfacenetwork_interface_out
Log Actionvendor_logging_profile
Time Loggedtime_received
Session IDsession_id
Repeat Countevent_repeat_count
Source Portsource_port
Destination Portdestination_port
NAT Source Portsource_nat_port
NAT Destination Portdestination_nat_port
Flagsvendor_flags
IP Protocolnetwork_transport
Actionvendor_event_action
Tunneltunnel
FUTURE_USEfuture_use_1
FUTURE_USEfuture_use_2
Source VM UUIDsource_vsys_uuid
Destination VM UUIDdestination_vsys_uuid
UUID for rulerule_uuid
Stage for Client to Firewallhs_stage_c2f
Stage for Firewall to Serverhs_stage_f2s
TLS Versioncrypto_protocol_version
Key Exchange Algorithmtls_keyxchg
Encryption Algorithmtls_enc
Hash Algorithmtls_auth
Policy Namepolicy_name
Elliptic Curveec_curve
Error Indexerr_index
Root Statusroot_status
Chain Statuschain_status
Proxy Typeproxy_type
Certificate Serial Numbercrypto_certificate_serial_number
Fingerprintfingerprint
Certificate Start Datecrypto_certificate_activation_time
Certificate End Datecrypto_certificate_expiration_time
Certificate Versioncrypto_certificate_version
Certificate Sizecert_size
Common Name Lengthcn_len
Issuer Common Name Lengthcrypto_certificate_issuer_len
Root Common Name Lengthrootcn_len
SNI Lengthsni_len
Certificate Flagscert_flags
Subject Common Namecn
Issuer Subject Common Namecrypto_certificate_issuer
Root Subject Common Nameroot_cn
Server Name Indicationsni
Errorevent_error_description
Container IDcontainer_id
POD Namespacecontainer_namespace
POD Namecontainer_name
Source External Dynamic Listvendor_src_edl
Destination External Dynamic Listvendor_dst_edl
Source Dynamic Address Groupvendor_src_dag
Destination Dynamic Address Groupvendor_dst_dag
High Res Timestampevent_created
Source Device Categorysource_category
Source Device Profilevendor_source_profile
Source Device Modelsource_device_model
Source Device Vendorsource_device_vendor
Source Device OS Familysource_os_name
Source Device OS Versionsource_os_version
Source Hostnamesource_hostname
Source Mac Addresssource_mac
Destination Device Categorydestination_category
Destination Device Profilevendor_destination_profile
Destination Device Modeldestination_device_model
Destination Device Vendordestination_device_vendor
Destination Device OS Familydestination_os_name
Destination Device OS Versiondestination_os_version
Destination Hostnamedestination_hostname
Destination Mac Addressdestination_mac
Sequence Numberevent_uid
Action Flagsvendor_log_panorama
Device Group Hierarchy Level 1vendor_dev_group_level_1
Device Group Hierarchy Level 2vendor_dev_group_level_2
Device Group Hierarchy Level 3vendor_dev_group_level_3
Device Group Hierarchy Level 4vendor_dev_group_level_4
Virtual System Namehost_virtfw_hostname
Device Nameevent_observer_hostname
Virtual System IDhost_virtfw_uid
Application Subcategoryapplication_subcategory
Application Categoryapplication_category
Application Technologyapplication_technology
Application Riskapplication_risk
Application Characteristicapplication_characteristic
Application Containerapplication_container
Application SaaSapplication_is_saas
Application Sanctioned Stateapplication_sanctioned_state
Cluster Namecluster_name
Flow Typeflow_type

GlobalProtect logs

Лог форматын жишээ:

1,2024/11/27 11:45:44,007954000533467,GLOBALPROTECT,0,2817,2024/11/27 11:45:44,vsys1,gateway-config-release,configuration,,,test,172.16.0.0-172.31.255.255,DESKTOP-FNV6TE0,172.16.14.19,0.0.0.0,192.168.40.1,0.0.0.0,23fd01a8-11d4-44cd-8be9-774d7e1b68a5,6ZVJD02,6.3.1,Windows,\"Microsoft Windows 10 Pro , 64-bit\",1,,,,success,,0,,0,Test GP GW,7441913159746584601,0x0,2024-11-27T11:45:46.019-08:00,,,,,,0,0,0,0,,PA-VM,1,

Нормчилсон талбарууд:

Palo Alto fieldsIlluminate fields
Virtual Systemhost_virtfw_id
Event IDvendor_event_name
Stagevendor_tunnel_stage
Authentication Methodvendor_auth_method
Tunnel Typenetwork_tunnel_type
Source Useruser_name
Source Regionvendor_source_region
Machine Namesource_hostname or source_ip
Public IPsource_ip
Public IPv6source_ipv6
Private IPsource_nat_ip
Private IPv6source_nat_ipv6
Host IDvendor_gp_hostid
Serial Numbersource_id
Client Versionvendor_gp_client_version
Client OSsource_os_name
Client OS Versionsource_os_version
Repeat Countevent_repeat_count
Reasonvendor_gp_reason
Errorevent_error_description
Descriptionvendor_gp_error_extended
Statusvendor_event_outcome
Locationvendor_gp_location_name
Login Durationnetwork_tunnel_duration
Connect Methodvendor_gp_connect_method
Error Codeevent_error_code
Portaldestination_hostname
Sequence Numberevent_uid
Action Flagsvendor_log_panorama
High Res Timestampevent_created
Selection Typevendor_selection_type
Response Timeapplication_response_time
Priorityvendor_gateway_priority
Attempted Gatewaysvendor_attempted_gateways
Gatewayvendor_gateway
Device Group Hierarchy Level 1vendor_dev_group_level_1
Device Group Hierarchy Level 2vendor_dev_group_level_2
Device Group Hierarchy Level 3vendor_dev_group_level_3
Device Group Hierarchy Level 4vendor_dev_group_level_4
Virtual System Namehost_virtfw_hostname
Device Nameevent_observer_hostname
Virtual System IDhost_virtfw_uid
Cluster Namecluster_name

HIP match logs

Лог форматын жишээ:

1,2024/11/27 11:45:02,007954000533467,HIPMATCH,0,2817,2024/11/27 11:45:02,test,vsys1,DESKTOP-FNV6TE0,Windows,192.168.40.1,Test_HIP,1,object,,,7441913164041551873,0x0,0,0,0,0,,PA-VM,1,0.0.0.0,23fd01a8-11d4-44cd-8be9-774d7e1b68a5,6ZVJD02,,2024-11-27T11:45:03.231-08:00,

Нормчилсон талбарууд:

Palo Alto fieldsIlluminate fields
Source Useruser_name
Virtual Systemhost_virtfw_id
Machine Namehost_hostname
Operating Systemhost_type
Source Addresshost_ip
HIPvendor_hipmatch_name
Repeat Countevent_repeat_count
HIP Typevendor_hipmatch_type
Sequence Numberevent_uid
Action Flagsvendor_log_panorama
Device Group Hierarchy Level 1vendor_dev_group_level_1
Device Group Hierarchy Level 2vendor_dev_group_level_2
Device Group Hierarchy Level 3vendor_dev_group_level_3
Device Group Hierarchy Level 4vendor_dev_group_level_4
Virtual System Namehost_virtfw_hostname
Device Nameevent_observer_hostname
Virtual System IDhost_virtfw_uid
IPv6 Source Addresshost_ipv6
Host IDvendor_gp_hostid
User Device Serial Numberhost_id
Device MAC Addresssource_mac
High Resolution Timestampevent_created
Cluster Namecluster_name

System logs

Лог форматын жишээ:

1,2024/10/08 12:04:25,,SYSTEM,general,2816,2024/10/08 12:04:25,,general,,0,0,general,informational,\"Connection to Update server: updates.paloaltonetworks.com completed successfully, initiated by 172.16.14.40\",7421534605078955497,0x0,0,0,0,0,,PA-VM,0,0,2024-10-08T12:04:25.668-07:00

Нормчилсон талбарууд:

Palo Alto fieldsIlluminate fields
Virtual Systemhost_virtfw_id
Event IDvendor_event_name
Objectvendor_event_object
Modulevendor_module
Severityevent_severity
Descriptionmessage
Sequence Numberevent_uid
Action Flagsvendor_log_panorama
Device Group Hierarchy Level 1vendor_dev_group_level_1
Device Group Hierarchy Level 2vendor_dev_group_level_2
Device Group Hierarchy Level 3vendor_dev_group_level_3
Device Group Hierarchy Level 4vendor_dev_group_level_4
Virtual System Namehost_virtfw_hostname
Device Nameevent_observer_hostname
High Resolution Timestampevent_created

Threat logs

Лог форматын жишээ:

1,2024/12/18 03:45:54,007954000533467,THREAT,virus,2817,2024/12/18 03:45:54,172.16.16.11,89.238.73.97,172.16.14.28,89.238.73.97,LAN_WAN,,,web-browsing,vsys1,LAN_Zone,WAN_Zone,ethernet1/1,ethernet1/3,Licen_PA,2024/12/18 03:45:54,307,1,49878,443,39152,443,0x1402000,tcp,reset-server,\"eicar.com\",Eicar Test File(100000),any,medium,server-to-client,7449709697914896384,0x0,172.16.0.0-172.31.255.255,Germany,,,0,,,1,,,,,,,,0,0,0,0,0,,PA-VM,,,,,0,,0,,N/A,js,Antivirus-5010-5528,0x0,0,4294967295,,,b8b30cde-a128-468c-a1ca-69fc9cd04b22,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0,2024-12-18T03:45:54.944-08:00,,,,internet-utility,general-internet,browser-based,4,\"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use\",,web-browsing,no,no,,,NonProxyTraffic

Нормчилсон талбарууд:

Palo Alto fieldsIlluminate fields
Source Addresssource_ip
Destination Addressdestination_ip
NAT Source IPsource_nat_ip
NAT Destination IPdestination_nat_ip
Rule Namerule_name
Source Usersource_user_name
Destination Userdestination_user_name
Applicationapplication_name
Virtual Systemhost_virtfw_id
Source Zonesource_zone
Destination Zonedestination_zone
Inbound Interfacenetwork_interface_in
Outbound Interfacenetwork_interface_out
Log Actionvendor_logging_profile
Session IDsession_id
Repeat Countevent_repeat_count
Source Portsource_port
Destination Portdestination_port
NAT Source Portsource_nat_port
NAT Destination Portdestination_nat_port
Flagsvendor_flags
IP Protocolnetwork_transport
Actionvendor_event_action
URL/Filenamealert_indicator
Threat IDalert_signature
Categoryevent_category
Severityvendor_alert_severity
Directionvendor_alert_direction
Sequence Numberevent_uid
Action Flagsvendor_log_panorama
Source Locationsource_location_name
Destination Locationdestination_location_name
Content Typehttp_content_type
PCAP_IDvendor_pcap_id
File Digestvendor_wildfire_hash
Cloudvendor_cloud_hostname
URL Indexvendor_url_index
User Agenthttp_user_agent_name
File Typefile_type
X-Forwarded-Forhttp_xff
Refererhttp_referrer
Sendersource_user_email
Subjectemail_subject
Recipienttarget_user_email
Report IDvendor_wildfire_report_id
Device Group Hierarchy Level 1vendor_dev_group_level_1
Device Group Hierarchy Level 2vendor_dev_group_level_2
Device Group Hierarchy Level 3vendor_dev_group_level_3
Device Group Hierarchy Level 4vendor_dev_group_level_4
Virtual System Namehost_virtfw_hostname
Device Nameevent_observer_hostname
Source VM UUIDsource_vsys_uuid
Destination VM UUIDdestination_vsys_uuid
HTTP Methodhttp_method
Tunnel ID/IMSIvendor_tunnel_id
Monitor Tag/IMEIvendor_monitor_tag
Parent Session IDvendor_parent_session_id
Parent Start Timevendor_parent_start_time
Tunnel Typenetwork_tunnel_type
Threat Categoryvendor_threat_category
Content Versionalert_definitions_version
SCTP Association IDvendor_assoc_id
SCTP Chunksvendor_sctp_chunks_sum
SCTP Chunks Sentvendor_sctp_chunks_tx
SCTP Chunks Receivedvendor_sctp_chunks_rx
Rule UUIDpolicy_uid
HTTP/2 Connectionvendor_http2
Dynamic User Group Namevendor_dynusergroup_name
XFF Addresshttp_xff_address
Source Device Categorysource_category
Source Device Profilevendor_source_profile
Source Device Modelsource_device_model
Source Device Vendorsource_device_vendor
Source Device OS Familysource_os_name
Source Device OS Versionsource_os_version
Source Hostnamesource_hostname
Source MAC Addresssource_mac
Destination Device Categorydestination_category
Destination Device Profilevendor_destination_profile
Destination Device Modeldestination_device_model
Destination Device Vendordestination_device_vendor
Destination Device OS Familydestination_os_name
Destination Device OS Versiondestination_os_version
Destination Hostnamedestination_hostname
Destination MAC Addressdestination_mac
Container IDcontainer_id
POD Namespacecontainer_namespace
POD Namecontainer_name
Source External Dynamic Listvendor_src_edl
Destination External Dynamic Listvendor_dst_edl
Host IDvendor_host_id
Serial Numbervendor_host_sn
Domain EDLvendor_domain_edl
Source Dynamic Address Groupvendor_src_dag
Destination Dynamic Address Groupvendor_dst_dag
Partial Hashvendor_partial_hash
High Resolution Timestampevent_created
Reasonvendor_event_outcome_reason
Justificationvendor_event_justification
A Slice Service Typevendor_nsdsai_sst
Application Subcategoryapplication_subcategory
Application Categoryapplication_category
Application Technologyapplication_technology
Application Riskapplication_risk_level
Application Characteristicapplication_characteristic
Application Containerapplication_container
Tunneled Applicationtunneled_app
Application SaaSapplication_is_saas
Application Sanctioned Stateapplication_sanctioned_state
Cloud Report IDcloud_reportid
Cluster Namecluster_name
Flow Typeflow_type

Traffic logs

Лог форматын жишээ:

1,2024/10/03 00:38:31,,TRAFFIC,end,2816,2024/10/03 00:38:31,172.16.16.11,172.16.14.40,172.16.14.28,172.16.14.40,LAN-WAN,,,ping,vsys1,LAN_Zone,WAN_Zone,ethernet1/1,ethernet1/3,Traffic_log1,2024/10/03 00:38:31,16,4,0,0,0,0,0x500019,icmp,allow,592,296,296,8,2024/10/03 00:38:15,0,any,,7421447455897550886,0x0,172.16.0.0-172.31.255.255,172.16.0.0-172.31.255.255,,4,4,aged-out,0,0,0,0,,PA-VM,from-policy,,,0,,0,,N/A,0,0,0,0,1c467ae3-1dd7-4dd3-976e-c2e6d98e7cc2,0,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2024-10-03T00:38:31.407-07:00,,,internet-utility,general-internet,network-protocol,2,\"has-known-vulnerability,tunnel-other-application,pervasive-use\",,untunneled,no,no,0,NonProxyTraffic,

Нормчилсон талбарууд:

Palo Alto fieldsIlluminate fields
Source Addresssource_ip
Destination Addressdestination_ip
NAT Source IPsource_nat_ip
NAT Destination IPdestination_nat_ip
Rule Namerule_name
Source Useruser_name
Destination Userdestination_user_name
Applicationapplication_name
Virtual Systemhost_virtfw_id
Source Zonesource_zone
Destination Zonedestination_zone
Inbound Interfacenetwork_interface_in
Outbound Interfacenetwork_interface_out
Log Actionvendor_logging_profile
Session IDsession_id
Repeat Countevent_repeat_count
Source Portsource_port
Destination Portdestination_port
NAT Source Portsource_nat_port
NAT Destination Portdestination_nat_port
Flagsvendor_flags
IP Protocolnetwork_transport
Actionvendor_event_action
Bytesnetwork_bytes
Bytes Sentsource_bytes_sent
Bytes Receiveddestination_bytes_sent
Packetsnetwork_packets
Start Timeevent_start
Elapsed Timeevent_duration
Categoryhttp_uri_category
Sequence Numberevent_uid
Action Flagsvendor_log_panorama
Source Countrysource_location_name
Destination Countrydestination_location_name
Packets Sentsource_packets_sent
Packets Receiveddestination_packets_sent
Session End Reasonvendor_session_end_reason
Device Group Hierarchy Level 1vendor_dev_group_level_1
Device Group Hierarchy Level 2vendor_dev_group_level_2
Device Group Hierarchy Level 3vendor_dev_group_level_3
Device Group Hierarchy Level 4vendor_dev_group_level_4
Virtual System Namehost_virtfw_hostname
Device Nameevent_observer_hostname
Action Sourcevendor_event_description
Source VM UUIDsource_vsys_uuid
Destination VM UUIDdestination_vsys_uuid
Rule UUIDrule_uuid
Stage for Client to Firewallhs_stage_c2f
Stage for Firewall to Serverhs_stage_f2s
TLS Versioncrypto_protocol_version
Key Exchange Algorithmtls_keyxchg
Encryption Algorithmtls_enc
Hash Algorithmtls_auth
Policy Namepolicy_name
Elliptic Curveec_curve
Error Indexerr_index
Root Statusroot_status
Chain Statuschain_status
Proxy Typeproxy_type
Certificate Serial Numbercrypto_certificate_serial_number
Fingerprintfingerprint
Certificate Start Datenotbefore
Certificate End Datenotafter
Certificate Versioncrypto_certificate_version
Certificate Sizecert_size
Common Name Lengthcn_len
Issuer Common Name Lengthcrypto_certificate_issuer_len
Root Common Name Lengthrootcn_len
SNI Lengthsni_len
Certificate Flagscert_flags
Subject Common Namecn
Issuer Subject Common Namecrypto_certificate_issuer
Root Subject Common Nameroot_cn
Server Name Indicationsni
Errorevent_error_description
Container IDcontainer_id
POD Namespacecontainer_namespace
POD Namecontainer_name
Source External Dynamic Listvendor_src_edl
Destination External Dynamic Listvendor_dst_edl
Source Dynamic Address Groupvendor_src_dag
Destination Dynamic Address Groupvendor_dst_dag
High Res Timestampevent_created
Source Device Categorysource_category
Source Device Profilevendor_source_profile
Source Device Modelsource_device_model
Source Device Vendorsource_device_vendor
Source Device OS Familysource_os_name
Source Device OS Versionsource_os_version
Source Hostnamesource_hostname
Source Mac Addresssource_mac
Destination Device Categorydestination_category
Destination Device Profilevendor_destination_profile
Destination Device Modeldestination_device_model
Destination Device Vendordestination_device_vendor
Destination Device OS Familydestination_os_name
Destination Device OS Versiondestination_os_version
Destination Hostnamedestination_hostname
Destination Mac Addressdestination_mac
Container IDcontainer_id
POD Namespacecontainer_namespace
POD Namecontainer_name
Source External Dynamic Listvendor_src_edl
Destination External Dynamic Listvendor_dst_edl
Source Dynamic Address Groupvendor_src_dag
Destination Dynamic Address Groupvendor_dst_dag
Host IDvendor_host_id
Serial Numbervendor_host_sn
Source Dynamic Address Groupvendor_src_dag
Destination Dynamic Address Groupvendor_dst_dag
Session Ownervendor_session_owner
High Resolution Timestampevent_created
A Slice Service Typevendor_nsdsai_sst
A Slice Differentiatorvendor_nsdsai_sd
Application Subcategoryapplication_subcategory
Application Categoryapplication_category
Application Technologyapplication_technology
Application Riskapplication_risk
Application Characteristicapplication_characteristic
Application Containerapplication_container
Tunneled Applicationtunneled_app
Application SaaSapplication_is_saas
Application Sanctioned Stateapplication_sanctioned_state
Offloadedoffloaded
Flow Typeflow_type
Cluster Namecluster_name

User-ID logs

Лог форматын жишээ:

1,2024/11/27 11:45:44,007954000533467,USERID,logout,2817,2024/11/27 11:45:44,vsys1,192.168.40.1,test,,0,1,0,0,0,vpn-client,globalprotect,7441913164041551877,0x0,0,0,0,0,,PA-VM,1,,2024/11/27 11:45:46,1,0x0,test,,2024-11-27T11:45:46.015-08:00,,client-to-server,

Нормчилсон талбарууд:

Palo Alto fieldsIlluminate fields
Virtual Systemhost_virtfw_id
Source IPsource_ip
Useruser_name*
Data Source Namevendor_datasource_name
Event IDvendor_event_name
Repeat Countevent_repeat_count
Time Out Thresholdvendor_timeout
Source Portsource_port
Destination Portdestination_port
Data Sourcevendor_datasource
Data Source Typevendor_datasource_type
Sequence Numberevent_uid
Action Flagsvendor_log_panorama
Device Group Hierarchy Level 1vendor_dev_group_level_1
Device Group Hierarchy Level 2vendor_dev_group_level_2
Device Group Hierarchy Level 3vendor_dev_group_level_3
Device Group Hierarchy Level 4vendor_dev_group_level_4
Virtual System Namehost_virtfw_hostname
Device Nameevent_observer_hostname
Virtual System IDhost_virtfw_uid
Factor Typevendor_factor_type
Factor Completion Timevendor_factor_completion_time
Factor Numbervendor_factor_number
User Group Flagsvendor_user_group_flags
User by Sourceuser_name_by_source*
Tag Nametag_name
High Resolution Timestampevent_created
Origin Data Sourceorigin_data_source
Cluster Namecluster_name

Тэмдэглэл

Illuminate 6.3.2-оос өмнө User нь source_user, User by Source нь vendor_source_user гэж гаргаж авагддаг байсан.

Illuminate нь User ID логийн message талбарыг (ердийн үед CSV форматтай үйл явдлын өгөгдөл) тухайн үйл явдлын илүү товч хураангуй болгон дарж бичнэ. Орлуулагч мессеж дараах загварыг ашиглана:

User-ID:{user_name} discovery:{vendor_log_subtype}, data source:{vendor_datasource} (name:{vendor_datasource_name}, type:{vendor_datasource_type})

Жишээ:

User-ID:corpuser discovery:login, data source:agent (name:CORPSYS1, type:)

Баяжуулалт

Illuminate нь үйл явдлуудтай ажиллахад хялбар болгохын тулд тэдгээрийг өгөгдлөөр баяжуулна.

application_risk

Зарим Palo Alto лог нь бүртгэгдсэн аппликейшнуудын application_risk_level талбарт оноо 1 (хамгийн бага) -ээс 5 (хамгийн их) хүртэлх үнэлгээний тоон эрсдэлийн оноог агуулна. Illuminate нь мөн тоон эрсдэлийн оноонд харгалзах үнэлгээг илэрхийлсэн текст утгыг өгдөг application_risk_score талбарыг нэмнэ.

Palo Alto 11 Spotlight content pack

Palo Alto 11 Spotlight Pack нь дараах табуудтай ерөнхий dashboard санал болгоно: Overview, Traffic, Threat, Global Protect, URL Filtering, Decryption.

Энэ хуудсанд гарсан нэр томъёо

Policy
Хамгаалалтын тохиргооны багц; төхөөрөмж эсвэл бүлэгт оноодог
Network
Таны байгууллагын бүх төхөөрөмжийн жагсаалт (Inventory)
Reports
Тайлан; хугацаагаар илгээх боломжтой
Асуулт байна уу?AI туслах GravityZone-ийн монгол баримтаас хайна. Нарийн асуудлыг таны гэрээт борлуулагч, Bitdefender Mongolia-ийн инженер шийднэ.