topic Re: What do 'SML VM Checks' and 'Detector Threats' do? in General Topics

What do 'SML VM Checks' and 'Detector Threats' do?

KiCheon.Lee — Thu, 08 Aug 2013 09:00:07 GMT

Hello

What do 'SML VM Checks' and 'Detector Threats' do in software pool?

These value was 1 when delayed to connect Web-Server.

Connection is normal when these value was high.

What do theses do? and what something do these influence FW?

Thanks

Re: What do 'SML VM Checks' and 'Detector Threats' do?

kprakash — Thu, 08 Aug 2013 13:00:41 GMT

There are functions related to content and threat detection. What is the version on the firewall?

BR,

Karthik

Re: What do 'SML VM Checks' and 'Detector Threats' do?

Chatri — Thu, 08 Aug 2013 13:17:07 GMT

Detector threat pool is responsible for correlating the pattern matches ( on traffic that has been decoded by the content engine of the FW) and the action set. This is in a nut shell is responsible for alerting on any matched threat signatures.

Re: What do 'SML VM Checks' and 'Detector Threats' do?

KiCheon.Lee — Fri, 09 Aug 2013 05:54:20 GMT

This version is 5.0.4

Re: What do 'SML VM Checks' and 'Detector Threats' do?

kprakash — Fri, 09 Aug 2013 15:55:06 GMT

Did you experience a latency in the traffic, when you saw the counters drop to this value? Can you elaborate more about that you meant by "delayed to connect Web-Server",

Can you try configuring the DSRI option on the firewall as mentioned in the below links, to see if it makes a difference.

https://live.paloaltonetworks.com/message/21078#21078

https://live.paloaltonetworks.com/docs/DOC-3821

Threat Prevention performance will not be impacted by the number of Threat Prevention profiles or the number of signatures that are enabled thanks to the single pass parallel processing architecture (SP3) unique to the Palo Alto

Networks firewall. Any session content is inspected in parallel by the Antivirus, Anti-Spyware and Vulnerability Protection features. One notable configuration setting that will have a positive impact on performance is DSRI or Disable Server

Response Inspection. With DSRI turned on, server response traffic is not inspected, which will increase the throughput capacity. Obviously, enabling this feature is only recommended for trusted servers.

Best regards,

Karthik