topic Re: Threat ID in the ranges between 8700-8799, Packet Based Attacks Protections in "Zone Protection" profiles in Advanced Threat Prevention Discussions

Threat ID in the ranges between 8700-8799, Packet Based Attacks Protections in "Zone Protection" profiles

Jitaphon — Mon, 05 Sep 2022 11:24:08 GMT

My customer is worry for log about threat id 8725.

this log is no impact on this device?

I know this is the expected behavior. Exceptions for these signatures are not to be found under the "Vulnerability Protection Profile".

Re: Threat ID in the ranges between 8700-8799, Packet Based Attacks Protections in "Zone Protection" profiles

Jitaphon — Wed, 07 Sep 2022 01:57:01 GMT

Anyone can give answer or not?
I need to know this log is no impact on this device?

Re: Threat ID in the ranges between 8700-8799, Packet Based Attacks Protections in "Zone Protection" profiles

ymiyashita — Mon, 24 Oct 2022 02:34:17 GMT

Here's what it means.
Threat-ID 8725: This event detects and strips the TCP Fast Open option (and data payload, if any) from the TCP SYN or SYN-ACK packet during a TCP three-way handshake.

It may disrupt applications that use TCP Fast Open.
There's no security impact on the device.

As already mentioned above, there's no exception option for 8725 in the vulnerability profile.
Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkrWCAQ