topic Re: vulnerability and spyware showing in monitor need to check its blocked from PA or not and need more clarity on same in Advanced Threat Prevention Discussions

vulnerability and spyware showing in monitor need to check its blocked from PA or not and need more clarity on same

sureshukkalkar — Sun, 15 Aug 2021 10:52:43 GMT

vulnerability and spyware showing in monitor need to check its blocked from PA or not and need more clarity on same

Re: vulnerability and spyware showing in monitor need to check its blocked from PA or not and need more clarity on same

rubber_ducky — Mon, 16 Aug 2021 05:29:06 GMT

The threat logs will show what action has been taken.Can you pls elaborate what your issue is? Do you wish to block the threats?

Re: vulnerability and spyware showing in monitor need to check its blocked from PA or not and need more clarity on same

sureshukkalkar — Mon, 16 Aug 2021 06:29:00 GMT

Hi,

Please suggest.

DCS-2530L Unauthenticated Information Disclosure Vulnerability :- Action- reset both

ZGrab Application Layer Scanner Detection :- :- Action- alert

name-of-threatid eq 'generic:in-page-push.com :- Action :- sinkhole

Zeroshell Remote Command Execution Vulnerability :- Action- reset both

Re: vulnerability and spyware showing in monitor need to check its blocked from PA or not and need more clarity on same

rubber_ducky — Mon, 16 Aug 2021 10:12:13 GMT

You can check the below url for more clarity on the different actions that Palo Alto takes on a traffic.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/objects/objects-security-profiles/actions-in-security-profiles.html

For you to decide if you need to block any threat, you should be able to double check by analysing the Src/Dst IPs to see if the traffic is valid in your environment.

Incase of url, doble check the url. Please DO ALWAYS check if you are seeing any false positves.

You can create security policy to completely block these Ips, if they are really threats. If you feel the src and dst are valid then Palo Alto may be blocking genuine traffic. You may need to exclude the IPs in the threat signature.

Click on the magnifying glass in the threat logs to view more details.