Recent Discussions
Logs from Azure are encrypted on Qradar
Hello everyone we are integrating CATO to send events to an azure and from there our SIEM service will collect the logs using Qradar. The workflow is: Cato > container > logic app > event hub. we are getting logs on Qradar but they seem to be encrypted. when we download the logs from the container to a local PC they are readable. this is my first attempt with azure integration so i have no idea where too start.. Thanks
Always on VPN and troubleshooting connectivity issues
Hi, I wanted to check if anyone else have experienced issues with the users enabled for Always On when their SDP client can not connect. Ocasionaly we see clients can not connect showing different errors, like username not recognized, can not connect, etc. The problem is that our Zoho Assist remote management software is not available if the user laptop is not connected to Internet which it is not when using Always On. How do you guys provide support in this scenario? What we usually do is first disable Always on policy for that user and then re-install the CAto client using either local admin or service desk user account. The problem is that we need to change the passwords to those accounts after giving out to the user by phone. Basically we just need Zoho Assist client traffic to bypass Cato tunnel, we will be testing split tunnel feature and adding Zoho IPs to bypass. Curious to hear your thoughts. Thanks!
Connectivity Alert Email - Interface Names
Hello, By default, the notification emails regarding a disconnected or degraded socket interface include the public IP address of the interface under "Interface Name". This does not match the port name in the socket configuration panel. Is it possible to modify this email template to include the descriptive name instead of, or ideally in addition to, the public IP address? This would be extremely helpful for quickly identifying which ISP is impacted. Not all network engineers have every single public IP in the company committed to memory! (Pictures have been redacted/edited to remove or alter sensitive information)Event logs limited to 100 events only
On theevents page in CMA, only the most recent 100 events are visible. Srolling though earlier events is not available. In order to search for earlier events you need to set filters, and even then only 100 events are listed. In normal day hundreds of thousands of events are generated. It would be helpful if we could just scroll though the events and do deeper dive into events that need attention. Rather than have to guess which filters to apply when troublshooting an issue.Bypass L7 from socket device
Hi community, Like the “Exclude Applications from Split Tunnel Policy Rules” available from the SDP client, is this functionality available from the socket ? Many customers have lot of teams and outlook traffic and need to bypass it directly from the socket. Many reasons for that (improve performance and save bandwitdh to the Cato Cloud) The actual bypass (from/to) IP is not usable for teams and outlook traffic. Thanks
