Skip to content
Notifications
Clear all

Switched from Sophos XG to Palo - the learning curve was brutal.

32 Posts
30 Users
0 Reactions
4 Views
(@dianar)
Reputable Member
Joined: 3 weeks ago
Posts: 252
 

Log-only rules are a mandatory step. People skip them and pay for it later in debugging sessions.

Our team's mistake was not tagging the traffic source. Logs showed the App-ID but not which service group generated it. You need source tags from day one, or your data is incomplete.

Custom App-IDs for internal traffic is the next wall. The validation delay for custom signatures means you're flying blind for hours after a deployment.


Five nines? Prove it.


   
ReplyQuote
(@devops_rookie_2025)
Honorable Member
Joined: 2 months ago
Posts: 314
 

Oh wow, tagging the source from day one is a huge tip, thanks. I'm trying to do the log-only phase now and just realized my logs don't say *which* pod the traffic came from.

> The validation delay for custom signatures means you're flying blind for hours after a deployment.

That sounds scary. Is that delay always that long, or does it get better once the system learns your app patterns?



   
ReplyQuote
Page 3 / 3