topic Spyware threat alerts in Next-Generation Firewall Discussions

Spyware threat alerts

Ryan_Volante — Fri, 01 Mar 2024 06:34:21 GMT

I would like to validate if the below monitored traffic on our internal firewall is service-affecting. How can we address this dropped traffic?

How can we cleanup these alerts? The same alert is shown on another FW 3430. Is it a normal behavior of firewall management IP to send DNS query?

Re: Spyware threat alerts

suba_muthuram — Fri, 01 Mar 2024 06:50:44 GMT

You can configure DNS Sink holing to find out which actual IP Address generating this Spyware traffic, Based on that you can scan your device.

Use the below document to configure DNS Sink holing.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0

Re: Spyware threat alerts

Ryan_Volante — Fri, 01 Mar 2024 07:09:47 GMT

Once we get to identify the IP address generating this spyware traffic, what will be the best approach to do next? And does it mean that this IP address is infected by a virus(spyware) or something?

Re: Spyware threat alerts

suba_muthuram — Fri, 01 Mar 2024 10:43:42 GMT

yes, There could be a possibility, the best approach is scan the host with an Antivirus software and verify is there any specific application has infected.