topic Re: Host Sweep in Advanced Threat Prevention Discussions

Host Sweep

tdevic — Mon, 20 Dec 2021 13:05:05 GMT

Our Zone Protection | Hoist Sweep configuration was blocking Internet connections on some local hosts due to enabled "News and Interests" Windows 10 Toolbar. I hope this helps with troubleshooting.

Re: Host Sweep

ymiyashita — Tue, 21 Dec 2021 01:10:11 GMT

It would depend on how the zone protection is configured. For the traffic from Trust to Untrust, it shouldn't be too strict especially when it's configured with "Block IP" action.
I'd also suggest to check the traffic log or sessions to see what kind traffic is matching with the condition. You may also want to capture packets on the Windows 10 machine with/without "News and Interests" toolbar enabled.

For your reference:
How do I analyze alerts for SCAN: Host Sweep (8002)?
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBioCAG

Re: Host Sweep

laurence64 — Tue, 21 Dec 2021 15:53:11 GMT

Yes I agree with the @ymiyashita it is tricky to get the right balance when applying the zone protection to any trusted zones, especially ones that have user internet traffic behind them as often applications will be trying to connect to any number of endpoints and normally the health of these is decided by pinging a port or an IP,

For instance PIA or private internet access pings pretty much all it's endpoints constantly to check if they are available and does this even if it is not switched on.

The only way to apply this is to, over time adjust the levels to the point where you have a baseline of normal volumes and then you can allow for anomalies to activate the protections.

Hope this helps.