PA-820 Threat License attack passed

KaloyanKirchev — Thu, 30 Jan 2020 09:33:41 GMT

Hello Guys,

This is my first post here and I am very sad.

I am big fan of PA and had a couple of implementations with customers but...

Sadly, last sunday, PA-820 appliances in HA were not enough to stop hackers/attack.

Customer of mine had some public exposed servers(public services).

In log files I saw many login attempts and no Brute-force signature engaged.

Interesting is here in the screenshot.

1. Vulnerability stopped and than again....login attempt:

All internal serves and infrastructure were down and has to be REBUILD from scratch. 😞

PLEASE give advice on how to "fine tune" vulnerability protection to stop these kind and future threats.

Somewhere I read that brute-force timers/attempts should be managed but I think this is not enough.

Maybe the login attempts were not the only problem.

I can show traffic logs for many login attempts BUT No threats.

P.S.: Of course it has Threat License and company DID loose huge amount of money as Monday morning there were no servers.

I would be happy to receive any help.

Re: PA-820 Threat License attack passed

reaper — Tue, 11 Feb 2020 14:45:43 GMT

for critical level threats and specifically for brute force threats I usually set a block-ip action for a good amount of time to discourage hammering internal resources

topic PA-820 Threat License attack passed in Advanced Threat Prevention Discussions

PA-820 Threat License attack passed

Re: PA-820 Threat License attack passed