topic Re: Default threat ID correlation for action in General Topics

Default threat ID correlation for action

craigmueller — Mon, 30 Jun 2014 19:34:59 GMT

Hi all,

I was searching for a while and could not find the answer to this question.

By default, does a Palo Alto block every instance a threat ID (that is enabled) is seen or does it wait until 1 threat ID hits 5 times in 1 minute (for example).

I would think it would be the former, but was searching for confirmation.

Thanks

Re: Default threat ID correlation for action

hshah — Mon, 30 Jun 2014 20:58:35 GMT

Hello Craig,

If threat ID has default action RESET than it will stop in first instance. So, it depends on default action of threat.

There is a different case in Vulnerability. Lets say there is a vuln. for bruteforce. And Palo Alto conclude it bruteforce if there are more than 60 attempts in 1 minutes. So in these type of scenarios we check the hits.

Best thing is to understand threat details, firewall will behave case to case bases.

Regards,

Hardik Shah

Re: Default threat ID correlation for action

craigmueller — Mon, 30 Jun 2014 21:03:14 GMT

Hardik,

Let's take HTTP Unauthorized Brute-force Attack (40031) for example and it's set to the default action of allow. You are saying, there would have to be 60 attempts within 1 minute before an alert would be created?

Do you have a link to these figures?

Re: Default threat ID correlation for action

hshah — Mon, 30 Jun 2014 21:07:03 GMT

Hi Craig,

You are right about the behavior, certain number of attempts within 1 minute can trigger vulnerability 40031. And it will only generate a Threat log, because default action is Alert, not Reset.

Regards,

Hardik Shah

Re: Default threat ID correlation for action

kadak — Mon, 30 Jun 2014 21:07:14 GMT

Hello craigmueller,

Here is the link you are looking for :

Trigger Conditions for Brute Force Signatures

Hope that helps!

Thanks and regards,

Kunal Adak

Re: Default threat ID correlation for action

craigmueller — Mon, 30 Jun 2014 21:15:10 GMT

Thank you for the link.

Are there separate lists for each group of signatures? Like 40022 or 40008.

Re: Default threat ID correlation for action

hshah — Mon, 30 Jun 2014 22:22:24 GMT

Hi Craig,

There may not be, but why do you need it?

Regards,

Hardik Shah

Re: Default threat ID correlation for action

craigmueller — Mon, 30 Jun 2014 22:24:45 GMT

I was looking for more information on the threat IDs and what triggers the alerts.

Re: Default threat ID correlation for action

hshah — Mon, 30 Jun 2014 22:43:44 GMT

Hi Craig,

Normally PAN doesnt disclose that information unless asked by specific customer for specific ID.

Regards,

Hardik Shah

Re: Default threat ID correlation for action

craigmueller — Mon, 30 Jun 2014 22:45:24 GMT

ok, thanks everyone for the information