topic Re: How Palo alto detect virus in General Topics

How Palo alto detect virus

soporteseguridad — Thu, 04 Jul 2013 11:09:10 GMT

Last week my client suffered a virus attack in its LAN and we have not seen anything in Palo Alto (monitor threat). I wanted to know how good is Palo Alto detecting virus and why reasons the PA didnt detect this virus. Anyone has had any similar problem.

thanks a lot

Re: How Palo alto detect virus

Retired Member — Thu, 04 Jul 2013 11:15:21 GMT

You can search for the virus that you found with other vendor or etc.. using https://threatvault.paloaltonetworks.com/

maybe there is no signature for that or maybe it is false positive for PaloAlto.

Re: How Palo alto detect virus

VinceM — Thu, 04 Jul 2013 12:51:10 GMT

Maybe virus didn't go through the palo or using a rule with no security profile.

Re: How Palo alto detect virus

kprakash — Thu, 04 Jul 2013 14:11:08 GMT

Do you have the traffic logs, and the information about the virus? In cases where the attack could have been a zero day attack, we can use the wildfire functionanlity of the PANFW to report unknown signatures to the cloud, analyze these signatures and determine if they are malicious or not.

BR,

Karthik RP

Re: How Palo alto detect virus

mikand — Thu, 04 Jul 2013 18:12:41 GMT

Other things to take into account (if the download actually passed the PA) is if ssl was used or not and if so did you have ssl-decryption enabled?

If you have a copy of the malicious file you could try to upload it manually to wildfire and see which opinion wildfire has on the file in question (first login to https://support.paloaltonetworks.com):

https://wildfire.paloaltonetworks.com/

Re: How Palo alto detect virus

ericgearhart — Fri, 26 Jul 2013 00:09:03 GMT

can you please reply? You had a few different people who have had the courtesy of asking you for more information in this thread that you started who are trying to help you...

Re: How Palo alto detect virus

ukhapre — Fri, 26 Jul 2013 19:35:10 GMT

DOS protection and Zone protection is typically applied for attacks.

Make sure to apply DOS protection to the security rule.

Zone protection profile needs to be assigned to respective Zone.

Make sure the content is uptodate and security rules are using AV, Vulnerability profile.

If you find some virus which was not covered, pcaps/relevant URLs can be submitted to add the coverage.

Wildfire can be configured which can help us identify the suspicious traffic.