topic Re: Submit a New Threat in Custom Signatures

Submit a New Threat

bkluth — Thu, 03 Dec 2015 18:46:20 GMT

Hello,

My IDS has detected a new Angler signature on my network and it was allowed by my PA firewall. The traffic was allowed being the IDS is not inline. How do I submit packets for a threat update/addition?

Re: Submit a New Threat

rcole — Thu, 03 Dec 2015 18:51:00 GMT

Bkluth:

This forum is for custom signature creation; for official content requests for PAN supported content coverage, please open a support case through the traditional process and provide all data gathered.

If you're interested in a custom signature creation for this type of traffic, you can provide it here.

Re: Submit a New Threat

bkluth — Thu, 03 Dec 2015 19:32:38 GMT

Ok. Thank you for the clarification, although I cannot select a device to receive support for after selecting, "new case." There isn't a streamlined way to submit new threats? That's odd.

Re: Submit a New Threat

rcole — Thu, 03 Dec 2015 19:37:54 GMT

Bkluth:

The current method for reporting new threats and missed detection is to have a support case opened and ask to work with a threat specialist, where we will triage the issue and work with our research and development team to assist you in every way possible to close any gaps in coverage, provided that actionable data is available.

There are automated methods for submitting URL recategorization for malware sites, but currently working with the threat speciailist division of the support team designed to assist you is the most effective avenue.

If you are having trouble creating a case, Support <Support@paloaltonetworks.com> can assist you with this process, as our CSR folks are very experienced at addressing support accessibility issues.

Re: Submit a New Threat

HITSSEC — Thu, 03 Dec 2015 20:12:31 GMT

bkluth,

As a best practice we put all IP addresses hosting an exploit kit (Angler, Rig or Nuclear) on a dynamic blocklist we do this upon notification of the IPS log event. Looking at all traffic going to the site that is hosting the exploit kit sometimes shows other users going there. The Impact to them is not known as there is sometimes no IPS event, no files coming down and sometimes no other network behaviors. Our rationale is that there is nothing good at that IP address.

Phil