topic Paloalto detected vulnerability traffic but the traffic is allowed in General Topics

Paloalto detected vulnerability traffic but the traffic is allowed

saighanasyam42 — Sat, 28 Oct 2017 15:47:32 GMT

Hi Guys,

SIEM tool - QRadar

Firewall - Paloalto

Received one exploit alert in our siem console

Source ip is internal workstation reaching to external remote public ips like yahoo,aws

alert name is exploit events across multiple targets containing generic prompt xss vulnerability

Paloalto detected the vulnerability traffic and sent those logs to SIEM however the traffic is allowed in paloalto
what might be the reason?

Re: Paloalto detected vulnerability traffic but the traffic is allowed

reaper — Mon, 30 Oct 2017 14:32:49 GMT

have you checke dthe threat log? there should be an associated action to the threat which is tied to the configuration of the security profile assovciated with the security policy that allows the session to start

if the threat is of severifty 'informational; for example, the default action is typically 'alert' which simply generates a log but takes no action