topic Re: How to Analyse threats in General Topics

How to Analyse threats

spriyadarshini — Mon, 28 Nov 2011 13:34:16 GMT

Hi all,

Can anybody suggest me how to analyse threats that's been alerted by Palo alto device.

What is the analysis approach?
Please advice.

Re: How to Analyse threats

ppatel — Mon, 28 Nov 2011 21:30:49 GMT

Hi Priyadarshini,

When the Palo Alto device captures the threats, you see them in the threat logs. ( Monitor--> Threat logs)

In order to see the threat id of the threat being detected click on the small magnifying icon on the left first column to get the details of that particular threat.

Go to the Support portal,

https://support.paloaltonetworks.com

Go to threat database and enter the threat id.

You will get the details of the threat.

You can also get the pcap of the threat.

o to Objects--> Profiles---> Antivirus Profiles---> Enable packet capture

If you think it is not a threat (False positive)and is being detected please contact Palo Alto Networks Support in order to open a case and have the issue resolved.

Thanks

Parth

Re: How to Analyse threats

spriyadarshini — Tue, 29 Nov 2011 07:45:44 GMT

Thank you Patel

Your answer is very helpful.

I would also like to know what steps should I take to analyse the threat once its been reported by IDS i.e How to analyse that our internal system is vunerable or not.

Let me explain with an example.

say Http:IIS denial of service attack is reported by Palalto.Then what steps to be follow for analysis.Generally an alert provides us information on source ip,Destination ip,threat name,threat id,port number.....with these details how to proceed.

Thanks & regards

priyadarshini

Re: How to Analyse threats

gafrol — Tue, 29 Nov 2011 14:44:22 GMT

If you look at the threat details you'll find the link to the corresponding Microsft Bulletin. This link usually tells you which patches you need to apply in order to be protected from the threat. rgds Roland