Abnormal SSL traffic on 443

LaportePitts — Fri, 21 Jan 2022 15:26:41 GMT

Hello I was looking into an pan threat on the logs I noticed that I Abnormal traffic is being detected does anyone have any ideas to minimize the threat or Best Practices or more possible features I can add to the Panorama

Thanks

Re: Abnormal SSL traffic on 443

ymiyashita — Tue, 01 Feb 2022 04:41:29 GMT

From your description, I understand that you are seeing "Abnormal SSL traffic on port 443 (54699)" detected on the firewall and on the panorama you are seeing the threat log forwarded by the firewall.
https://threatvault.paloaltonetworks.com/?query=Abnormal SSL traffic on 443&type=

I would advise you to take a threat pcap and verify if the traffic is actually abnormal. Most likely, the SSL handshake is missing.
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/take-packet-captures/take-a-threat-packet-capture.html

If it's a true positive, you can change the default action to block the traffic to minimize the threat since it's an abnormal traffic.
STEPS TO CHANGE THE DEFAULT ACTION FOR SIGNATURES
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm3KCAS

topic Abnormal SSL traffic on 443 in Advanced Threat Prevention Discussions

Abnormal SSL traffic on 443

Re: Abnormal SSL traffic on 443