topic Action is Reset-Both in the Detail Log view area in General Topics

Action is Reset-Both in the Detail Log view area

AdamCoombs — Fri, 01 Sep 2017 16:37:19 GMT

Hello everyone question,

I have been seeing this on the Threat montior area. I just need someone to verify what I am seeing is correct.

This shows me that action was reset-both, which tells me file never got inside

When I look at the Detailed Log View it shows something else. I am thinking that issue was not reset but file did get downloaded. If anyone can help me with this would be great.

I sort this by recieved time, so what I am thinking is the file has been downloaded.

Here is Type sort the same way

Here is Bytes sorted the same way too

Also when I look at the Destination area you can see that all is file out expected the Victim Name

Help with understanding all this please.

Re: Action is Reset-Both in the Detail Log view area

Raido_Rattameister — Fri, 01 Sep 2017 17:40:56 GMT

Palo performs stream based antivirus.

If it find virus inside file while it is passing by it will reset connection.

Even if client received beginning of file it is not an issue - until whole file was not transferred it will not be executed.

You can check Data Filtering log if this session transferred any file through firewall.

Re: Action is Reset-Both in the Detail Log view area

reaper — Mon, 04 Sep 2017 08:32:37 GMT

as @Raido_Rattameister mentions, the firewall does not proxy connections, but instead allows packets to flow through and scans them for behavior and threats as they pass through. If abnormalities or threats are detected, the flow will be interrupted or corrective action is taken, depending on the need (eg. threats are dropped/reset, while url filtering is injected with a redirect to a block page etc..)

Re: Action is Reset-Both in the Detail Log view area

AdamCoombs — Thu, 07 Sep 2017 20:12:01 GMT

First sorry Raido I did not see you post something here.

Thank you for the information.

I did check the Data Filtering log I see action was allow, this traffic was filter but allow here.

But since there was a reset-both action that means the file got reset on both sides so no one got infected file on there computer right ?