Custom Threat is being identified, but not taking the correct action.

tom.mccomb — Tue, 17 Sep 2019 15:55:46 GMT

We have a custom vulnerability for Datanyze Scraping that is being idenfied but only alerting. This signature looks for http-req-headers and dns-req-headers for the value of Datanyze. This is working great, I can see the traffic in the threat log so I know it is being properly identified.

The configuration of the signature has it set as Severity: Medium, Default Action: Reset Both, Direction: Both and Affected System: Client-and-server.

I checked the policies where the traffic is coming in on and it has the correct vulnerability profile. Note that on the profile we have criticals - mediums set to do a reset-both. We also are not using app-id on this policy but traditional 80/443 service ports.

Any idea why this would be happening? My next step is a support ticket but would like to figure this one out on my own.

topic Custom Threat is being identified, but not taking the correct action. in Custom Signatures

Custom Threat is being identified, but not taking the correct action.