Config Log Forwarding

[@aritramuherjee2737]

Thanks...this is very helpful. Kindly make a session for paloalto mschapv2 configuration with Radius server

[@andrewohanian5132]

I didn't realize Wildfire can issue multiple verdicts for a submitted file. So it can indeed issue a verdict of malicious AND phishing? At 10:28 the presenter says "either malicious OR phishing verdicts" so I'm wondering if that connector should have been "or" instead.

[@futbolcamilo8410]

agree, should be OR

[@RishiRap]

"Nice Video. But could you pls also mention how to verify from CLI. I tried "show logging-status" & "show log-setting preference" command but still did not get clear picture. I could not find any cli commands to verify all those syslog entries in log forwarding profile and not even to verify syslog profiles.

[@lukeb0030]

at 9:00 where you created the filter for WildFire logs - you used an 'and' operator but afterwards you kept speaking of it as though it was an 'or' operator. Is that a mistake ? Does it need to match both malicious and phishing to be forwarded - or would a match on either result in the log being forwarded ?

[@Danlovestrivium]

No, what he created means that it would have to match on both the 'malicious' and 'phishing' categories or it will not send the log. Based on how he built this, he's going to be missing a lot (if not all) of the alerts he's hoping to receive from the Wildfire Log Type. The correct connector, in this case, would to have the setting of "Or" as opposed to "And" in order to trigger a log forward condition on either one of these filters.

[@kbhushan12]

Excellent video.

[@RicardoMartinez-vo7hv]

What about user id logs? I cannot add a match condition for user id logs ina log forwarding profile.

[@lukeb0030]

Check under Device > logging settings for User-ID log forwarding