topic Invalid threat ID number, next steps in General Topics

Invalid threat ID number, next steps

tstores — Tue, 20 Aug 2013 00:14:56 GMT

In the threat logs, the PAN is detecting a virus for internal traffic, server to client, but the threat id doesn't match anything in the threat vault, 1 number too short, 253879. What's the best way to identify if the threat is legitimate, not a false positive? application = ms-ds-smb, url LogoinScript.VBS

Re: Invalid threat ID number, next steps

HULK — Tue, 20 Aug 2013 00:46:28 GMT

Hi,

If you share your login scripts with us, we will be able to verify the false positive/negative test for it. Also wanted to know, is the file passing through the PANFW while you are logging into the machine..?

Thanks