topic SYSTEM ALERT : medium : Could not access threat vault in General Topics

SYSTEM ALERT : medium : Could not access threat vault

Fariq_Zaidi — Wed, 04 Sep 2024 09:39:22 GMT

Hi All,

Can anyone show me how to troubleshoot this alert? or this alert is false positive?

SYSTEM ALERT : medium : Could not access threat vault

as per logs is only show 1 time only

Thank you

Re: SYSTEM ALERT : medium : Could not access threat vault

kiwi — Wed, 04 Sep 2024 12:14:21 GMT

Hi @Fariq_Zaidi ,

This is a general alert that indicates the firewall was unable to connect to the threatvault.paloaltonetworks.com server. This is a database server in Palo Alto Networks for the firewall to pull information on threat IDs.

This does not affect the traffic through the firewall in any way, it's only informational. A possible reason for not being able to connect would be that the firewall cannot resolve the threatvault.paloaltonetworks.com server.

from the firewall CLI please run

> request resolve address api.threatvault.paloaltonetworks.com

> request resolve address threatvault.paloaltonetworks.com

Also if the traffic from the management interface is going through a firewall please check the traffic logs and verify that session to threatvault are not being dropped/denied.

Kind regards,

-Kim.

Re: SYSTEM ALERT : medium : Could not access threat vault

Fariq_Zaidi — Wed, 11 Sep 2024 02:55:41 GMT

Hi Kim,

can you let me know what happen if the firewall not able to access the threat vault? is the traffic will still able to block or drop threat?

Thank you

Re: SYSTEM ALERT : medium : Could not access threat vault

kiwi — Wed, 11 Sep 2024 10:49:46 GMT

Hi @Fariq_Zaidi ,

Yes, if your firewall has downloaded/installed a dynamic content update (for example Antivirus or Apps & Threats) then it has those signatures to block threats.

Hope this helps,

-Kim.