topic Why there are 2 threats of same name but different severity in Advanced Threat Prevention Discussions

Why there are 2 threats of same name but different severity

raji_toor — Fri, 06 Oct 2017 20:48:57 GMT

I see these alerts with same name and description, where as one is considered low and other as medium.

Why do they even have different ID's

Re: Why there are 2 threats of same name but different severity

CTW1983 — Tue, 24 Oct 2017 22:29:18 GMT

They each have their own vulnerability signature, therefore a unique Threat ID. I see a total of 26 threats that are named "HTTP SQL Injection Attempt", 1-high, 23-medium, and 2-low in severity.

Re: Why there are 2 threats of same name but different severity

raji_toor — Mon, 30 Oct 2017 18:44:16 GMT

So should blocking be done based on severity only?

Re: Why there are 2 threats of same name but different severity

CTW1983 — Mon, 30 Oct 2017 21:40:08 GMT

I don't want to say based on severity "only", but for us it definitely helps simplify things so that everytime Palo Alto releases a new Threat ID we don't have to go configure a custom action for each one. We also don't feel comfortable using a default action of "alert" for a critical severity threat.

This is what we do... For critical, high, and medium threats we use "reset-both" action. For low threats we use "default" action (which uses the individual threat's action recommended by Palo Alto). For informational threats we use "allow" action. Then we use "exceptions" when we have a Threat ID we want configured differently than based on severity.