topic Threat blocked by Palo Alto: Is there anything else to do? in Advanced Threat Prevention Discussions

Threat blocked by Palo Alto: Is there anything else to do?

yschinck — Mon, 27 Aug 2018 14:15:01 GMT

Hi,

When the Palo Alto blocks a communication that is flags as a threat (ie: SQL Injection, XSS, etc.), should we investigate the target IP to make sure that the threat was blocked? The reason I'm asking is that whenever the Palo Alto blocks an attack from an IP address (Session End Reason is "threat"), if we go in the "Traffic" view, we can see that not all the communications with that offending IP were terminated with a "threat" reason. Some of them are terminated by "tcp-rst-from-client" or "tcp-rst-both". In that case, I'm wondering if part of the attack (or payload) could have gone through to the destination IP before the Palo Alto stopped it. Are these connections expected and there should be nothing to worry about, or should we still investigate?

Thank you.

Re: Threat blocked by Palo Alto: Is there anything else to do?

yschinck — Tue, 18 Sep 2018 12:48:43 GMT

Bump.

Should I just create a ticket and ask that question to the support directly...?

Re: Threat blocked by Palo Alto: Is there anything else to do?

OtakarKlier — Tue, 18 Sep 2018 14:15:08 GMT

Hello,

I would investigate, but it doesnt mean that thigns were compromised. It could have just been a scan and some of the traffic was allowed and some got blocked. While not always a good indicator, you have to look at all the traffic holistically, I look at the amount of data transferred, was it a large amount or small.

Hope that helps.