topic Re: TCP SYN with data Threat logs in Advanced Threat Prevention Discussions

TCP SYN with data Threat logs

leandro.ramos — Fri, 16 Mar 2018 15:01:33 GMT

Hi Guys,

I receive hundreds of TCP SYN with data Threat Alerts from my BYOD zone every day. I was learning more about it and I understood that it is a TCP syn packet with data in its payload. However, as almost all of them seems to come from non-malicious sources, I am not sure if I should worry about it or just consider it as a false positive and tweak my firewall.

Any advice would be much appreciated.

Thanks

Leandro Ramos

Re: TCP SYN with data Threat logs

mivaldi — Fri, 16 Mar 2018 17:02:02 GMT

If the firewall detects a TCP packet with data and your Zone Protection profile is set to drop these, then I wouldn't think it is a false positive. It triggers the protection because the firewall sees these.

More information available at:

https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/networking-features/zone-protection-for-syn-data-payloads

There is currently no way to inhibit these protections from writing to the Threat Logs, however, if you receive the alerts through a Log Forwarding profile, you can edit the profile so that these are not forwarded out using a Filter in PAN-OS 8.0:

(severity eq informational) and (threatid neq 8723)

Selective Log Forwarding

https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/management-features/selective-log-forwarding-based-on-log-attributes

Video Tutorial

https://live.paloaltonetworks.com/t5/Tutorials/Tutorial-Filtered-Log-Forwarding/ta-p/145950

Re: TCP SYN with data Threat logs

leandro.ramos — Mon, 19 Mar 2018 08:13:46 GMT

Hi Mivaldi,

Thank you very much for all the information provided.

Regards,

Leandro Ramos