topic Re: Requirements to alert an threat in General Topics

Requirements to alert an threat

ralf_hanl — Wed, 09 Jul 2014 13:42:36 GMT

Hello,

is there any possibility to get any information about the requirements for detecting an specific threat.

e.g. there is Signature ID : 13457 EBURY, what is this signature looking for ?

Do I have to decrypt anything on the PA to give a deeper look into the payload. Is it only examing the DNS traffic ?

Where could get access to the signature source ?

Thanks

Ralf

Re: Requirements to alert an threat

HULK — Wed, 09 Jul 2014 13:56:37 GMT

Hello Ralf,

As per my understanding, you will not be able to get the signature source ( for security reason). Please follow the mentioned link,you may get some more detailed information: An In-depth Analysis of Linux/Ebury

Thanks

Re: Requirements to alert an threat

HULK — Wed, 09 Jul 2014 14:42:52 GMT

Hello Ralf,

The default action is set for this threat is "ALEART". Hence, at any point of time if the signature triggers, the PAN firewall will generate a log for the same. GUI > Monitor > Logs > Threat. You may change the default action as mentioned below.

Thanks.

Re: Requirements to alert an threat

pulukas — Wed, 09 Jul 2014 23:38:45 GMT

The basic information that Palo Alto does provide can be found by searching in the Threat Vault.

https://threatvault.paloaltonetworks.com/

This document shows how to get more detailed information after seeing what is available from Palo Alto.

How to Find Virus Details if Not Available in the Threat Vault