topic Re: VPN disconnection when using the sbs robot, which performs queries to a certain page located in the internal network of an entity. in General Topics

VPN disconnection when using the sbs robot, which performs queries to a certain page located in the internal network of an entity.

F.Pinar — Fri, 07 Mar 2025 18:54:07 GMT

They mentioned that based on this behavior in which they think that this is a :

1.-Threat identification.
2.- VPN disconnection when using the sbs robot, which performs queries to a certain page located in the internal network of an entity (Judicial Power).

3. -Sbs query: add ip range in the policies so that a user group can access from vpn connection.

Have you ever had a case like this one ?

Re: VPN disconnection when using the sbs robot, which performs queries to a certain page located in the internal network of an entity.

BPry — Sun, 09 Mar 2025 05:17:22 GMT

@F.Pinar,

Can you provide more information on what this "sbs robot" is? Being identified as a threat doesn't immediately disconnect you from VPN by default, but it can depending on how you have things configured and what automation may be in play. This is something that you should be able to easily validate via the threat logs. Without knowing what this "sbs robot" is and what it's actively trying to accomplish it's difficult to provide any guidance.

Re: VPN disconnection when using the sbs robot, which performs queries to a certain page located in the internal network of an entity.

F.Pinar — Wed, 12 Mar 2025 18:15:31 GMT

Moreover, I checked the URL

https://urlfiltering.paloaltonetworks.com/
https://threatvault.paloaltonetworks.com/
URL: reinpros.pj.gob.pe
Categories: Government
Risk Level: Low-Risk
Category: Government
Description: Official websites for local, state, and national governments, as well as related agencies, services, or laws
Example Sites: www.ca.gov, www.sfgov.org, www.dmv.ca.gov
Risk Level: Low-Risk
Description: Any site that is not High Risk or Medium Risk. This includes sites that were previously confirmed as malicious but have displayed benign activity for at least 90 days
Example Sites: www.google.com, www.schwab.com, www.amazon.com
Besides, checked some reports based on the user mentioned "SBS_2"
2025-03-05 16:56:00.052 -0500 Error: pan_config_parse(pan_log_query.y:116): unable to parse single expr: dynusergroup_name in user.src eq 'sbs_2'
2025-03-05 16:56:00.128 -0500 Error: _pan_log_query_parse_single_expr(pan_log_query.c:12426): no function available for fieldname dynusergroup_name and op 3 for logtype 5
2025-03-05 16:56:00.128 -0500 Error: pan_log_query_parse_single_expr(pan_log_query.c:13222): failed to parse term: dynusergroup_name in user.src eq 'sbs_2' first round, try address expansion