Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 7 replies
  • Subscribers 1 subscriber
  • Views 9469 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Find Local Address for a Firewall event

MoltenArrow

When reviewing firewall events, specifically "No Application Rule" type, the console reports information based on the remote address but not the local address. This information would be extremely helpful to determine which AD OU that the machine which triggered the event lives in and correspondingly which Firewall policy is applied to it.  Is there anyway to determine this?

Enpoint: 10.0

Enterprise Console: 5.2.1.197

:43463


This thread was automatically locked due to age.
Parents
  • 0

    Hello MoltenArrow,

    location aware rules

    yes, was referring to them.

    some users, that report as being policy compliant, are triggering "No Application Rule"

    just nitpicking: policies apply to computers, not users.

    I assume you are using Block by default - but then, don't the users complain (asking because you did not mention it)? What do you do to unblock the browser - or is it an intermittent problem? Trust is a rule - did you check that it is correctly set on the client?

    Haven't heard of such an issue ... all I can think of is that the policy on the endpoint does not (yet) comply when the browser is opened.

    Christian 

    :43553
Reply
  • 0

    Hello MoltenArrow,

    location aware rules

    yes, was referring to them.

    some users, that report as being policy compliant, are triggering "No Application Rule"

    just nitpicking: policies apply to computers, not users.

    I assume you are using Block by default - but then, don't the users complain (asking because you did not mention it)? What do you do to unblock the browser - or is it an intermittent problem? Trust is a rule - did you check that it is correctly set on the client?

    Haven't heard of such an issue ... all I can think of is that the policy on the endpoint does not (yet) comply when the browser is opened.

    Christian 

    :43553
Children
No Data