topic Re: CVE-2021-44228 - Log4j vulnerability - Log4Shell in Firewall and Security Management

CVE-2021-44228 - Log4j vulnerability - Log4Shell

Mada — Wed, 15 Dec 2021 16:34:13 GMT

Hello CheckMates,

Can somebody check and let me know what kind of filter can be used via Smart-Console (R80.20), only to see the relevant logs details for "CVE-2021-44228 Log4j", just to see if there were any attack attempts or not?

Does also the Firewall blade also see these kind of logs or only the IPS blade?

I've already filtered as below, but not able to see any logs:

blade:IPS CVE-2021-44228

Is there another way to filter only for "industry_reference"?

A reply would be greatly appreciated.

Thank you in advance!

Re: CVE-2021-44228 - Log4j vulnerability - Log4Shell

PhoneBoy — Wed, 15 Dec 2021 18:35:59 GMT

This is an IPS signature, thus Firewall blade alone will not see it.

Re: CVE-2021-44228 - Log4j vulnerability - Log4Shell

the_rock — Wed, 15 Dec 2021 23:56:18 GMT

Just do log filter search like this in dashboard -> blade:IPS AND CVE-2021-44228

You will see lots of stuff, for sure.

Re: CVE-2021-44228 - Log4j vulnerability - Log4Shell

Mada — Thu, 16 Dec 2021 06:26:15 GMT

Thanks a lot for your feedback.

Re: CVE-2021-44228 - Log4j vulnerability - Log4Shell

Mada — Thu, 16 Dec 2021 06:26:42 GMT

Thanks for your feedback.