topic Re: Honey pot signature in Custom Signatures

Honey pot signature

viren.parasram — Mon, 26 Oct 2015 17:19:14 GMT

Hi,

I have certain subnets that are currently not in use in our domain, I wanted to ip-block for 30 minutes all ips that access any of these subnets. Is it possible to creat a threat signature for this?

Thanks,

VIREN

Re: Honey pot signature

rcole — Mon, 26 Oct 2015 18:00:47 GMT

Good afternoon, Viren!

Given the nature of our custom signature engine, I cannot think of a way to design a signature to accomplish what you are looking for.

However, what you are asking for may be possible with a Zone Protection profile under Reconnaissance Protection.

Please see this article for reference:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Block-an-IP-for-a-Specific-Period-upon-Detecting-Port/ta-p/65523

Hope this helps!

Re: Honey pot signature

viren.parasram — Tue, 27 Oct 2015 13:22:37 GMT

Hi,

Thanks for your suggestion, I will look into that. What I've been trying is to set up strict vulneabilities av virus url profiles with default block and applying them to the policy. I have a request for enhancement to allow for block ip at the group level but in the mean time I've added ip block to some brute force matches to get the desired effect. Waiting to see if this works.

THANKS,

VIREN

Re: Honey pot signature

HITSSEC — Fri, 30 Oct 2015 00:17:55 GMT

Viren,

To use custom signatures you need to tirgger on a defined traffic patten based on the contexts you have available for our use when creating a signature. Since you want a honeypot trigger the challenge you would have is what traffic are you going to trigger on? Might I suggest you create a security rule for you honeynet and use a logging profile that can alert you via txt message or email immediately upon being triggered.

Thought I would throw that out for your thoughts.

regards,

Phil