topic Re: Paloalto Threat Details - Signatures in General Topics

Paloalto Threat Details - Signatures

ajrockn — Thu, 21 Jan 2016 22:27:27 GMT

Could someone tell me when a signature gets detected in paloalto under Logs | Threat what None: means?

Thanks!

Re: Paloalto Threat Details - Signatures

syadav — Fri, 22 Jan 2016 03:03:10 GMT

@ajrockn can you tell which field in the threat log, you are referring to ?

Re: Paloalto Threat Details - Signatures

ajrockn — Fri, 22 Jan 2016 16:20:12 GMT

Its showing under the monitor tab | Logs | Threat and then under the Name column. Is this what your asking?

Re: Paloalto Threat Details - Signatures

syadav — Fri, 22 Jan 2016 16:43:55 GMT

@ajrockn The "None:" prefix seem to indicate the Threats (and corres. Thread ID) for domains which are identified (as suspicious) by "Wildfire content signatures"

> The range is as follows :

Wildfire Suspicious DNS Signatures: 3800000 - 4000000

https://live.paloaltonetworks.com/t5/Threat-Articles/Threat-ID-Ranges-in-the-Palo-Alto-Networks-Content-Database/ta-p/59969

Hence "None:" prefix seems to be a notation placeholder for this threat ID range.You should be able to confirm this by your observation of the IDs in the logs.