topic Re: Automatic attack block in General Topics

Automatic attack block

DPoppleton — Fri, 31 Mar 2017 14:55:28 GMT

Occaisionally we get an attack from a single IP to one of our external servers where the attacker tries a whole bunch of known exploits. Is there anything like a "Zone Protection" for this type of attack? I'm looking for something where an external bad actor gets blacklisted for a period of time after it tries a number of expolits.

Re: Automatic attack block

bradk14 — Fri, 31 Mar 2017 15:37:04 GMT

there may be a more direct, better way, but what immediately comes to mind to me is if you have a threat prevention license and these are actual CVEs already known by PA, you can configure the vulnerability protection profile to have an action of Block IP which will shun the offending IP for up to an hour.

Re: Automatic attack block

kiwi — Fri, 31 Mar 2017 15:48:12 GMT

Hi @DPoppleton,

I think you need DoS protection ?

A classified DOS protection profile allows the creation of a threshold that applies to a single source IP.

For example, a max session rate per IP can be created for all traffic matching the policy, then block that single IP address once the threshold is triggered for a certain amount of time which is configurable.

https://live.paloaltonetworks.com/t5/Featured-Articles/How-to-Set-Up-DoS-Protection/ta-p/71164

Hope it helps !

-Kiwi

Re: Automatic attack block

DPoppleton — Mon, 03 Apr 2017 13:01:50 GMT

These attackers don't hit at a high rate, they just run through known vulnerabilities, most of which the Palo sees and blocks. I would like a feature where if there are 5 hits against one IP of the known vulnerabilties then block all traffic for 1/2 an hour or so.

I'm thinking this might be a feature request.

Re: Automatic attack block

DPoppleton — Mon, 03 Apr 2017 13:03:07 GMT

I'll see if I can find this....