topic Re: MS-Update identified as a threat, there are no corresponding entries in the threat logs, URL filtering log or data filtering logs in Next-Generation Firewall Discussions

MS-Update identified as a threat, there are no corresponding entries in the threat logs, URL filtering log or data filtering logs

AkashThangavel — Wed, 29 Nov 2023 09:39:23 GMT

Hi team,

Although MS-Update was flagged as a threat, there are no corresponding entries in the threat logs, URL filtering logs, or data filtering logs explaining the basis for its classification as a threat

The first three logs indicate that the traffic is passing without the security profiles

Why MS-update is identified as a threat??

with regards,

Akash Thangavel

Network Security Engineer

Re: MS-Update identified as a threat, there are no corresponding entries in the threat logs, URL filtering log or data filtering logs

akuzhuppilly — Wed, 29 Nov 2023 09:10:49 GMT

Hello @AkashThangavel

To understand why certain ms-update traffic matches the criteria, you should examine the threat logs or URL filtering logs. Additionally, there is a known software issue (PAN-230250) that may cause this behavior. Please check if your case aligns with this issue.

You can find it in the PAN-OS 11.0.2 release notes, specifically under the "Known and Addressed Issues" section:

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-release-notes/pan-os-11-0-2-known-and-addressed-issues/pan-os-11-0-2-h2-addressed-issues