topic Re: How to verify that threat profiles are actually performing in Advanced Threat Prevention Discussions

How to verify that threat profiles are actually performing

mikec-utas — Thu, 29 Mar 2018 18:34:00 GMT

Hello,

I currently have one rule, that pertains to one inside and one outside host. I have a few profiles added to the rule such as a/v, spyware, vulnerability and file blocking. I dont see any events in the Threat monitor nor my Syslog server so my assumption is all is well, no threats detected? Is there any other way to confirm the firewall is performing the checks in the profile?

Thanks

Re: How to verify that threat profiles are actually performing

nescovedo — Thu, 29 Mar 2018 22:43:00 GMT

As long as the traffic is communication across the rule that has your threat profiles applied then it should be filtering. I would search the destination and source address and verify that the traffic is not hitting any other rules first.

Re: How to verify that threat profiles are actually performing

mikec-utas — Mon, 02 Apr 2018 18:01:21 GMT

Yes traffic is flowing. Wish there was some other level of verification regarding the applied threat-profiles

Thanks

Re: How to verify that threat profiles are actually performing

Retired Member — Fri, 08 Jun 2018 20:16:40 GMT

There are a few sites out there that will test it for you from the Internet IN.

Or go out and find an EICAR - eicar.org

Re: How to verify that threat profiles are actually performing

jjosephs — Thu, 14 Jun 2018 16:38:56 GMT

You may also refer to https://www.paloaltonetworks.com/documentation/81/wildfire/wf_api/get-wildfire-information-through-the-wildfire-api/get-a-malware-test-file-wildfire-api to pull some test files through your firewall to generate threat log entries