topic Re: IP blocked then allowed in Next-Generation Firewall Discussions

IP blocked then allowed

ridzuan.a — Fri, 19 Jan 2024 03:45:47 GMT

Hi,
I'm reviewing a logs regarding a low reputation IP which in the first log it's action is dropped, and 5 minutes later 3 logs with action allowed. Why does it dropped then allowed it?

Logs

category: spyware

action: dropped

Threat Name: CobaltStrike.Gen Command and Control Traffic
Threat ID: 18005

Re: IP blocked then allowed

ridzuan.a — Fri, 19 Jan 2024 03:46:26 GMT

I'm new to the forum, thanks in advance

Re: IP blocked then allowed

OtakarKlier — Mon, 22 Jan 2024 21:19:20 GMT

Hello,

Not sure if its the case here however logs are typically written at 'session end'. We would need to see redacted logs to try and figure this out. Just black out the source and destination IP's along with anything that could identify your company etc.

Regards,

Re: IP blocked then allowed

ridzuan.a — Tue, 23 Jan 2024 08:35:50 GMT

Hi, please find the ss below

Re: IP blocked then allowed

OtakarKlier — Tue, 23 Jan 2024 15:43:26 GMT

Hello,

So the 'later' traffic is UDP (DNS-Base) so it has to 'time out' since there is no fin packets. This is the most likely reason for the later timestamp in the logs. The policy is most likely set to log at session end, which is best practice.

Hope this helps.

Re: IP blocked then allowed

ridzuan.a — Wed, 24 Jan 2024 06:42:52 GMT

does UDP has fin packets?

Re: IP blocked then allowed

ridzuan.a — Wed, 24 Jan 2024 06:45:28 GMT

i did a bit of research from your explanation, using the first link below to understand the session end. then using data from Session End reason: threat, i found out the answer in the second link. thanks for your help

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCQlCAO

Re: IP blocked then allowed

OtakarKlier — Mon, 29 Jan 2024 17:41:20 GMT

Hello,

Glad you found what you needed.

Cheers!