In this video, we get to take a closer look at working with logs, specifically
viewing and searching logs.
And I also want to point out, I mentioned earlier, but I want to point out that
based on the version of 40 Analyze we're using,
and as time marches on, there'll be newer and newer versions, the features are
going to still exist, but they may move it around in the interface.
So as long as you're aware of what can be done with some examples we're going
to go through right now,
you can use these features on pretty much any version of 40 Analyzer.
Even if they choose to move some little aspect from one section of the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Even if they choose to move some little aspect from one section of the
interface to another.
So let's start off by logging into the 40 Analyzer and just confirm that these
three firewalls and this firewall are all logging to our root administrative
domain.
So here is our 40 Analyzer. It's currently showing us the administrative domain
we're in. It's the root administrative domain.
I also want to verify with device manager that we have these four 48 firewalls
that are all reporting in, which they are.
And they're all showing status of a fantastic. So for viewing the logs on the
left hand side, we're going to go to log view and then under log view, we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
left hand side, we're going to go to log view and then under log view, we're
going to go to logs.
Now currently it's in the same state I left it in from the previous video,
which is only looking at branch firewall.
And so let's take this from the top. So under logs, I currently have selected
four net logs, and then I have selected 40 gate.
And then from the 40 gates, I now have selected just firewall one. I'm going to
go ahead and say now all devices.
So now once I click on OK, we're looking at logs from all devices, but just for
the last five minutes.
So if the traffic logs you want to see, for example, forever, you can say WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if the traffic logs you want to see, for example, forever, you can say
anytime.
And those are the login information, not just for the last five minutes or a
period of time, but all log information from all devices.
So if we click this icon right here, it'll move the four net logs, thread
hunting and log browse over to the side.
So I'll go ahead and do that just to show you that. If you want it back at the
top, you can click here on toggle horizontal menu.
And again, they may change the interface from time to time, but all the
features and options are going to be there regardless of the version.
So just be prepared for things to move around a little bit over time.
So currently I've got four net logs at the top. I've got 40 gate firewall WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So currently I've got four net logs at the top. I've got 40 gate firewall
selected and currently all devices are selected.
And I have no constraint on the time range. Now, this is looking at the
historical logs, meaning it's not going to automatically refresh.
If you want to refresh, we click right here on refresh, and that would go get
the latest and greatest logs that have come in since that last screen.
Or we could get a more and say a real time log, and that's just going to update
the screen as new logs come in.
So we wait just a moment here. This is our at the moment, the last log that has WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we wait just a moment here. This is our at the moment, the last log that has
come in.
But because I have several PCs on, I just got a whole bunch of new logs and it
's coming in and we could go ahead and pause it right here.
Just be aware that we have those options. So I'm going to go back to more
historical log. And if we want to click on refresh, we certainly can.
But this way the screen's not going to move on us and I don't have to hit pause
and resume. And we can just do refresh when we need to.
So regarding the four, 48 firewalls that we have, we have three sets of logs
that we can look at.
The traffic is referring to traffic logs. And again, that depends on whether or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The traffic is referring to traffic logs. And again, that depends on whether or
not the 48 firewalls have logging set up for traffic, meaning all traffic.
So for example, we go back to firewall one and we go to our policy and objects
and we go to our firewall policy right here.
This policy right here called in out with LDAP off. If we scroll down as far as
logging goes, we're logging all sessions.
And so as a result, the traffic logs on this firewall are going to be sent over
to the 40 analyzer.
Now in addition on this 48 firewall, I've also got several security profiles
associated with the security policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
associated with the security policy.
And as a result, we're also going to have additional logs, including security
logs that are going to be sent over as well.
And those will be based on how these profiles are set up and when they're
matched as part of the firewall policy.
So click on cancel there. Let's go back to the 40 analyzer.
All right, so back to the 40 analyzer, looking at the historical logs and the
traffic logs.
The other type of logs that we can look at is under security. Now if we click
on security, it's going to show us a summary, which will show us all the
effectively the security profiles associated with the traffic logs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
effectively the security profiles associated with the traffic logs.
And with the policies that it's received, where there's been logging
information.
So if we click here on antivirus, it'll show us antivirus logs.
So I've got some that look like they're going to Germany.
Fantastic. That would be our I car test file under security.
If we go down to IPS for intrusion prevention, here it's showing some and I did
some testing that went out to looks like the Russian Federation and it was 80s
or three.
And if I go down to DNS, for example, here's log matches based on my DNS
security profile associated with that policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
security profile associated with that policy.
Or if we want to take a look at the summary, we can simply go to security
summary and it'll give us a nice big picture.
Now take a look at this. It's now sorted by the last hour.
So if we want to make sure we see longer than that, we can say, you know what,
I want to see the last two weeks and just change it.
So one thing that gets me a lot is I'll forget to look at the filters in place.
Also forget to look at the time range.
So just make sure when you don't see something you think you should see, just
make sure you have the time range set up correctly and you don't have a filter
in place that's filtering out content. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in place that's filtering out content.
You think you should be seeing.
So here for the summary regarding security logs, we have antivirus, web filter,
SSL, DNS, web application firewall, application control, intrusion prevention
and SSH.
I don't think I have an SSH profile in place.
I don't have a day loss prevention profile in place.
And I also don't have a file filter profile in places being used.
That's why those are showing up as empty.
And like most things on the 40 analyzer, if you want more details, you can just
go ahead and click. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go ahead and click.
And it can take you there.
So for example, here with web filtering, if I click on social networking, it
automatically puts a filter in for me.
And then furthermore, I could add more filtering to that.
For example, if I want to filter on, let's go ahead and scroll the right a
little bit.
In fact, I'm going to click on this hamburger icon up here to collapse to the
left hand side.
It gives a little more room.
And over here in sent and received, the yellow indicates block and the blue
indicates allowing traffic through.
So here in your social networking, I further make a filter and say, you know
what, I want to go ahead and right click on Facebook and say,
I also want to include just Facebook along with the action pass through and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I also want to include just Facebook along with the action pass through and
category social networking.
So I'll add Facebook to that.
Again, limiting the scope of what we're looking at.
And we wanted to find a category social networking where the action wasn't
passed through, we could go ahead and remove that from the filter.
I'm just going to highlight it and delete it and then click on search.
Then we could right click here.
For example, a pass through.
Again, we're in a security web filter with this time frame.
Then I could right click on pass through and say, you know what, I want to see
everything except for the action of pass through. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
everything except for the action of pass through.
And that should show us those that were blocked.
So this indicates that none of the logs I have regarding social media were
blocked.
Let me go ahead and clear that.
And let's use another example.
So here I've got web filter and let's go ahead and right click and I'll say
action not equal to pass through.
And this is going to show us where the action was something other than pass
through.
And here we have blocked.
Then I can further limit this down to specific categories.
So if I want to say for example, alcohol, where the action was not passed
through and the category was alcohol, I could right click and add that as an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
through and the category was alcohol, I could right click and add that as an
additional part of my filter.
So this is going to show us where the action is not passed through the
categories alcohol.
Then we get to roll down into these events as well.
So for example, this right here, we can double click and look at the details
regarding, you know, what happened, why it happened.
So this is being reported from firewall one, so we can just scroll down. There
's the action and the profile was called no alcohol, which is a web filtering
profile, which is specifically blocking on alcohol category of websites.
And they did that just as a demonstration. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And they did that just as a demonstration.
They want to clear the filter. We can clear it as well.
Also with the filter, let me talk about two different modes here as we look at
logs.
One mode is the filter mode.
And so we just click here and you can just specify what you want. For example,
I want the to equal, let's go ahead and say critical and apply.
And that's going to show us based on the other components here, any web
filtering where the level equal critical and there aren't any.
Let's go ahead and remove that and click on add filter.
And let's go ahead and say level is notice and click on apply and there we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's go ahead and say level is notice and click on apply and there we have
a whole bunch.
Then we get drilled down to that further.
Now another option instead of using the filter mode is we could go ahead and we
could say text mode, which is more prone to errors because we're typing it out.
So there's still help here in text mode. So let's go ahead and say action and
then we'll go ahead and say equal and then we go ahead and type in blocked.
And you can actually type here and add that as part of your filter and then
click on the search icon to have it go ahead and show you that.
But I prefer to use filter mode and I'll clear off that previous one and that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But I prefer to use filter mode and I'll clear off that previous one and that
way I can just add it by selecting and not have to worry about typos.
So those are examples of how we can use the security logs and is one of our
example.
Let's go to DNS and let's add a filter and this for the query type.
Let's go ahead and say equals an A record.
So an A record is just an IPV4 address record and a quad A is for IPV6 and
click on apply.
And that just shows the A records again we're under security DNS that's
regarding DNS profiles that are associated with our security policy that were
matched as traffic is going through the firewall. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
matched as traffic is going through the firewall.
So here we have this one right here if we want to investigate that we can just
double click on it.
So as we scroll down here's the user there's the firewall that's reporting it
and the action was pass and the profile is our DNS filter.
And here protocol 17 that's the protocol number for UDP which is the default
protocol used for a traditional kind of old school DNS request which is still
done millions of times a day on the Internet.
Another alternative to that would be using DNS over HTTPS or DNS using TLS. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Another alternative to that would be using DNS over HTTPS or DNS using TLS.
So based on what we're saying here it's a traditional DNS lookup.
So let's take a look at another example.
Let's go over to how about let's do application control. So here for
application control and also click on the gear and let's add the column for
level.
And for the moment let me go ahead and take off the date time and the profile
just gives a little more reading space here and let's take a look at the output
.
So here I have a couple options if we want to sort through this one is I can
say you know I don't want to see information so I can go ahead and click on
information and then say don't show that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
information and then say don't show that.
So I'm showing us for application control. I don't have any that are not at the
informational level. All right, so I go ahead and close that and let's use a
different security log.
Let's go to IPS. And so here's our severity here so we do say you know what I
only want to see high severity so we could right click here and include a
filter there or we're going to add filter good severity and say hi either way
is great and click and apply.
They would both create the filters for us now for these are very high it also
shows the action of detected but it implies that that traffic was not dropped WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
shows the action of detected but it implies that that traffic was not dropped
as a result so we double click on one of these and take a look.
So here the details it's a threat level high and looks like a sequel injection
attack reported by firewall one but it was allowed.
So because it says here user to look at the source IP address as well 10200102
let's bring up that computer. So here is PC to confirm its IP address and it's
at 1020 0.102 fantastic so if we bring up a browser.
I've got it there's a test site provided I think it's by IBM on the Internet
that's vulnerable. It's called all thorough mutual and the URL is test fire.net WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that's vulnerable. It's called all thorough mutual and the URL is test fire.net
.
So if we click here on log in check this out I've got a little sequel injection
attack right here it's a single quote space or space one equals one space dash
dash space I'm going to copy that and I'm going to go ahead and I'm going to
paste it as the user name and also paste it in as the password and click log in
and
share enough hello admin user so that just happens so we could just go back to
the 40 analyzer and say you know what let's go ahead and take a look at the
last five minutes and there it is right there AD user to and that traffic was WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
last five minutes and there it is right there AD user to and that traffic was
identified and if you double click.
So there's the threat the sequel injection and we scroll up here's the firewall
that's reporting it and if you scroll back down it's also showing the location
that the user was going to when they did this.
So that's effectively one of our users doing a sequel injection attack against
a server on the Internet so here for the application all default pass.
That's the profile that allowed that to happen so we could just go back to
firewall one let's do that right now and at firewall one let's go down to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
firewall one let's do that right now and at firewall one let's go down to
security profiles and there's intrusion prevention there's all default pass and
sure enough it has monitor.
So all default passes being used to show you the reference column one that
means we're having applied to this firewall policy and there's actually two
ways of stopping a sequel injection attack we can do it IPS profile we can also
do a web application firewall which would also do it but since we're looking at
intrusion prevention let's go ahead and take a look at how about this block
severity levels four and five. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
severity levels four and five.
So this will go ahead and block the high and critical let's go ahead and use
that instead so we'll go back to our firewall policy and then right here let's
go ahead and just click on edit and for IPS instead we'll say blocks have
already level four and five click on apply
and bought a Bing bought a boom that client should no longer be able to you
know do a sequel injection against some server on the Internet so we'll go back
to our client and go ahead and open a browser once again we'll go to that test
site and let me also copy into my buffer
that sequel injection that we can try again click on copy minimize that we'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that sequel injection that we can try again click on copy minimize that we'll
click on sign in and I'll go ahead and paste that in in both fields click on
login and this time the firewall killed it didn't let us go through
and also that information should be showing up inside of our logs as well so go
ahead and close that minimize the client and let's go back to 40 analyzer so
now if we come back and we'll put the last five minutes here and click on
refresh
it's now showing the action of dropped let's go back a little bit further let's
go back 30 minutes and here is showing the initial on where it was allowed and
all these others when the client in the background was attempting and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all these others when the client in the background was attempting and
attempting
and all of that was blocked and if we're curious about what that user has been
doing for example another option we need to go ahead and just right click on
user to create a filter matching just on that and it's IP address and then
remove security equals high and that would show us all of our activity for that
specific user
now the other cool thing that we can do with any of these logs traffic security
and event is we can also say you know what if we want to bring up the same
query in the future instead of going through and creating a filter we can also WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
query in the future instead of going through and creating a filter we can also
go ahead and create a custom view so let me add one more filter let me right
click on this and add a filter looking for exactly user to and the source
address of 10, 20, 0, 1, 0, 2 let's imagine we wanted to be able to use this in
the future but get to it really quick
this option right here create custom view is the perfect way to do that let's
call it user to severity high from 102 address and we can name it whatever we'd
like and so what we can do now is we can click on OK and now that's created as
a custom view where it's going to be exactly this so let me show you where it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a custom view where it's going to be exactly this so let me show you where it
put us to expand the left hand side
it took us to custom views and so we're going back to logs if we have a whole
bunch of custom views that are saved we're going to custom views and boom we
can just launch it again so let's create one more let's go back to logs and let
's imagine we want to create a custom view for what we want to do
we want to create a custom view for web filtering for the last 30 minutes based
on traffic going to YouTube.com so we'll add that as part of our filter and let
's also go ahead and search just on blocked so we'll add that as a filter so it
's host name YouTube.com and action blocked for the last 30 minutes we can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
's host name YouTube.com and action blocked for the last 30 minutes we can
create a custom view
call it blocked YouTube for past 30 click on OK and that's going to save it as
yet another custom view so here are the custom views up here we have user to
very high from 102 address
another custom view called blocked YouTube past 30 so we can just click on
those and automatically have those filters in place if you don't like them
anymore when I get rid of them just double click on the three dots and then you
can click on delete and that would remove that
however if you have a few that are really handy you can just have them ready as
custom views and then select them and away you go now another option that can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
custom views and then select them and away you go now another option that can
be kind of useful is the raw log view so let's imagine we are going to a
summary of our security events here
currently let's go ahead and say the last two weeks great great great and so
here for web filtering let's go down to the category of alcohol where it was
blocked so we'll click on that it currently implemented the filter for us and
it looks like we had two attempts from the same exact user
so to get even more detail we can of course double click on one to see this
information however we can also click here on more and go to raw log now this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
information however we can also click here on more and go to raw log now this
wouldn't be for the average you know days use but if we want to go into details
and see what's happening and take a look behind the scenes this could be a
helpful option
so if we go more and go to format log that would show us a nice friendly format
once again and again the blue is showing traffic that was sent and received
that was permitted and the yellow color here is indicating traffic that was
blocked
and if we wanted this to be a custom view once again just with it in place
click on create custom view and we'll call it alcohol blocked and we'll click
on okay so now under our custom views we have the user 2 is very high from 1 or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on okay so now under our custom views we have the user 2 is very high from 1 or
2 blocked YouTube past 30 minutes and we have alcohol blocked
which is super convenient if you have certain searches that you want to do just
with the click of a button this is how you can set up those custom views again
if you don't like them you can just go ahead and delete them and away they go
so going back to logs us also take a look at how we could view the 40 analyzer
logs so if you click on the 40 analyzer these are logs based at the 40 analyzer
so events things are going on I think of it like the brains of the 40 analyzer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so events things are going on I think of it like the brains of the 40 analyzer
in the background with performance statistics and so forth
and there's also an application sub tab here for the 40 analyzer and things
like configuration changes and other details are happening in the background on
the 40 analyzer but once again to go back to the 40 gates these are all the
traffic security and event logs from the 40 gates that are selected from this
list here
and also with the time constraint here and we go to events and go to summary is
showing us here for the last two weeks and here's the legend with the color
coding we scroll down here system events widget router events
SD WAN events VPN events scroll down user events and if you have a widget that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
SD WAN events VPN events scroll down user events and if you have a widget that
you're not needing or you don't use you can simply go ahead and remove it if
you want to add a widget it's also super easy to add a widget just by going to
here and adding it back in
and if you like these tabs for net logs threading log browse over on the side
here you can click this button in the upper right right there and if you want
to move max just click here on toggle horizontal menu and then it'll come back
at the top
and while we're here looking at logs there's one other option called thread
hunting which is quite amazing as well so with thread hunting you can specify WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
hunting which is quite amazing as well so with thread hunting you can specify
your time range for example let's go ahead and say the last
how about last 14 days is showing us the log counts and the dates involved
there and then we can click right here for example on threat type and then for
the threat type let's double click on botnet which will open that up as a
filter for us where the threat type is botnet
and further we could go ahead and double click on one of these for example let
's go ahead and double click on that one right there that gives us the details
over on the right hand side we're getting what's going on so this is reported
by
headquarters firewall one the event was a botnet command control communication WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
headquarters firewall one the event was a botnet command control communication
the profile was all default pass which implies based on the title of that
profile that it was allowing that traffic to go so the threat action was
detected and here is the threat name and the pattern it saw as well
then it has information on the threat pattern and the threat type of botnet and
if we scroll down here's our user ad user 3 which might cause us to start
investigating ad user 3 and or that source IP address to find out what else
that user is doing
so if we close that and we right click on user 3 here we could add a filter for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so if we close that and we right click on user 3 here we could add a filter for
just user 3 it looks like also user 2 is doing it as well so to add additional
filter for botnet and user 3 we could right click on user 3 here and say add
user 3 to the filter and that would filter just user 3
then we could also say you know what I want to go ahead and take a look at
these ones that are level notice we can adapt to the filter and just building
the filter for us as we go through and that gives us a great opportunity with
filtering just by using the log view by filtering down and finding out what's
going on on the network
and one other cool thing about 40 analyzer that I'm going to allude to right WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and one other cool thing about 40 analyzer that I'm going to allude to right
now is that if we see something that looks suspicious or you know like we need
to look at it further we can very easily create an incident in 40 analyzer and
then add information to it
tell triangulate and figure out what's going on with a specific user or
specific device as it communicates over the network and we'll cover event
handling and incident management in a separate set of videos but all this
information that we're digging into from the logs can help us in identifying
and confirming something that's negative happening on the network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and confirming something that's negative happening on the network
now another really cool option that for net provides for us in the 40 analyzer
is something called for to view and for view is going to be usable after the 40
analyzer receives data the log information and then puts it into the sequel
database we can then start leveraging it here with
40 view which is exactly what we're going to do in the very next video so I'll
see you there in just a moment