©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
173
Monitor
Network
Activity
Use
Case:
Respond
to
an
Incident
Using
Panorama
Review
Data
Filtering
Logs
The
data
filtering
log
(
Monitor > Logs > Data Filtering
)
is
another
valuable
source
for
investigating
malicious
network
activity.
While
you
can
periodically
review
the
logs
for
all
the
files
that
you
are
being
alerted
on,
you
can
also
use
the
logs
to
trace
file
and
data
transfers
to
or
from
the
victim
IP
address
or
user,
and
verify
the
direction
and
flow
of
traffic:
server
to
client
or
client
to
server.
To
recreate
the
events
that
preceded
and
followed
an
event,
filter
the
logs
for
the
victim
IP
address
as
a
destination,
and
review
the
logs
for
network
activity.
Because
Panorama
aggregates
information
from
all
managed
firewalls,
it
presents
a
good
overview
of
all
activity
in
your
network.
Some
of
the
other
visual
tools
that
you
can
use
to
survey
traffic
on
your
network
are
the
Threat Map
,
Traffic Map
,
and
the
Threat Monitor
.
The
threat
map
and
traffic
map
(
Monitor > AppScope >
Threat Map
or
Traffic Map
)
allow
you
to
visualize
the
geographic
regions
for
incoming
and
outgoing
traffic.
It
is
particularly
useful
for
viewing
unusual
activity
that
could
indicate
a
possible
attack
from
outside,
such
as
a
DDoS
attack.
If,
for
example,
you
do
not
have
many
business
transactions
with
Eastern
Europe,
and
the
map
reveals
an
abnormal
level
of
traffic
to
that
region,
click
into
the
corresponding
area
of
the
map
to
launch
and
view
the
ACC
information
on
the
top
applications,
traffic
details
on
the
session
count,
bytes
sent
and
received,
top
sources
and
destinations,
users
or
IP
addresses,
and
the
severity
of
the
threats
detected,
if
any.
The
threat
monitor
(
Monitor > AppScope > Threat Monitor
)
displays
the
top
ten
threats
on
your
network,
or
the
list
of
top
attackers
or
top
victims
on
the
network.
Update
Security
Policies
With
all
the
information
you
have
now
uncovered,
you
can
sketch
together
how
the
threat
impacts
your
network—the
scale
of
the
attack,
the
source,
the
compromised
hosts,
the
risk
factor—and
evaluate
what
changes,
if
any,
to
follow
through.
Here
are
some
suggestions
to
consider:
