Threat Prevention inspection

Zewwy — Tue, 18 Nov 2014 19:57:26 GMT

Hey there,

I've really been enjoying the Palo Alto ability to update itself with threats prevention signatures almost instantly (depending on ones setup)

I've been checking the ACC more latly and have notice the following:

I'll make some notes here:

1) This is only appearing to user who are using the Global Protect to VPN into the corporate network.

2) the Victim host is our SharePoint FE

3) We currently have an issue where constant Event ID 1 are populated on the SharePoint FE due to a miss configured Performance Point Service which (AFAIK) as been removed from every aspect of our SharePoint (we currently don't use scorecard, etc)

4) I don't know if these two issue are related in some way.

So my question is as follows is there any way I can get more details on each hit of this threat event? It'd be nice to click on the session and it displayed each session and time the event occurred/got triggered. Since these events are being done by legit users while remoteing in I'm not majorly concerned since I'm sure it has something to with the complex inner SharePoint permission structure (Even posting on TechNet, no one was able to tell me how to query any web parts that might be using performance point to track that event..)

But even for future threat sessions it be nice to see when they occurred to help track who was doing what when.. etc... please and thanks!

Re: Threat Prevention inspection

Retired Member — Tue, 18 Nov 2014 20:04:38 GMT

hi,

you have to filter and find these threats on Monitor/threat logs

so each session detail is there.if it is not enough , you may open packet capture for the related security profile.

Re: Threat Prevention inspection

Zewwy — Tue, 18 Nov 2014 22:21:27 GMT

Thnaks, That'll do panos.... That'll do

topic Re: Threat Prevention inspection in General Topics

Threat Prevention inspection

Re: Threat Prevention inspection

Re: Threat Prevention inspection