Port Scan Activity (External) too much noise but can there be a way to really Alert only on risky ports (config is vulnerable)

MManangan — Wed, 20 Apr 2022 15:43:28 GMT

I got an AHA/Idea (aka RFE) for Prisma Cloud's Network Anomaly of Port Scan Activity (external) as Prisma Cloud just alerts as-is if someone is knocking at our door regardless if the port is secure otherwise.

We want some intelligence built-in to check first if that port scanned is a real threat with a risky configuration but if it is hardened and secured then it should NOT alert at all to not add to the noise.

Here's my IDEA- please vote for it for the vendor to work into adding more checks and intelligence to the Policy:

PANW-I-2699

Re: Port Scan Activity (External) too much noise but can there be a way to really Alert only on risky ports (config is vulnerable)

JJoly — Fri, 22 Jul 2022 21:44:21 GMT

Hello @MManangan,

We investigated a bit on those alerts and in our context, it seems false positive most of the time.

I will vote on you request 🙂

topic Re: Port Scan Activity (External) too much noise but can there be a way to really Alert only on risky ports (config is vulnerable) in Prisma Cloud Discussions

Port Scan Activity (External) too much noise but can there be a way to really Alert only on risky ports (config is vulnerable)

Re: Port Scan Activity (External) too much noise but can there be a way to really Alert only on risky ports (config is vulnerable)