topic Re: unknown threat name in Advanced Threat Prevention Discussions

unknown threat name

Yang_Chen — Thu, 07 Feb 2019 15:34:13 GMT

Our firewall detected a spyware "C2-Bitsight-Prirrit" with threat id 15006. But I can't find any information about this spyware on Palo Alto's support site. The id seems non-exist. Could it be a mistake?

Re: unknown threat name

mivaldi — Thu, 07 Feb 2019 18:05:51 GMT

Can't find anything with that data. Can you share a screenshot, and also check what Content version the firewall is running?

Re: unknown threat name

Yang_Chen — Thu, 07 Feb 2019 19:07:09 GMT

Here's the screenshot.

Re: unknown threat name

mivaldi — Thu, 07 Feb 2019 19:48:48 GMT

Execute the "show system info" command on the CLI and share the output here please. You can except or blur-out the IP addresses.

Re: unknown threat name

Yang_Chen — Thu, 07 Feb 2019 20:08:52 GMT

hostname: Super
ip-address: 10.10.10.10
netmask: 255.255.255.0
default-gateway: 10.10.10.60
ip-assignment: static
ipv6-address: unknown
ipv6-link-local-address: fe80::290:fbff:fe55:3d49/64
ipv6-default-gateway:
mac-address: 00:90:fb:55:3d:49
time: Thu Feb 7 15:06:53 2019
uptime: 168 days, 17:23:57
family: 7000
model: PA-7050
serial: 010108001018
sw-version: 8.0.12
global-protect-client-package-version: 0.0.0
app-version: 8120-5288
app-release-date: 2019/02/05 17:31:22
av-version: 2882-3392
av-release-date: 2019/02/07 04:04:58
threat-version: 8120-5288
threat-release-date: 2019/02/05 17:31:22
wf-private-version: 0
wf-private-release-date: unknown
url-db: paloaltonetworks
wildfire-version: 109647-110819
wildfire-release-date: 2017/01/27 15:27:41
url-filtering-version: 20190207.20242
global-protect-datafile-version: unknown
global-protect-datafile-release-date: unknown
global-protect-clientless-vpn-version: 0
global-protect-clientless-vpn-release-date: unknown
logdb-version: 8.0.16
platform-family: 7000
vpn-disable-mode: off
multi-vsys: on
operational-mode: normal

Re: unknown threat name

mivaldi — Thu, 07 Feb 2019 21:03:55 GMT

Your packages seem to be up to date. Very strange. Please have a case opened with Support.

Re: unknown threat name

Yang_Chen — Fri, 08 Feb 2019 14:40:45 GMT

Thanks. I have opened a ticked.