topic Re: Exempt alerting for specific threat in General Topics

Exempt alerting for specific threat

raji_toor — Wed, 10 Jan 2018 19:37:55 GMT

We have an open wifi network and do see lot of coinhive spyware threat alerts. Recently a user genrated in excess 30000 email alerts for CoinHive JavaScript Detection. We don't want to block the user and also the external IP is not single one. Firewall is set to reset-bot on detection. We just don't want to see this email alert, is there a workaround to disable alert on a specific spyware.

Re: Exempt alerting for specific threat

OtakarKlier — Wed, 10 Jan 2018 22:14:45 GMT

Hello,

Yes there is. Just use the exception tab to filter the one you dont want to see out. Set it something lower and change the action.

Hope that helps.

Re: Exempt alerting for specific threat

raji_toor — Wed, 10 Jan 2018 22:50:44 GMT

How would you change the severity of threat under exceptions? SMTP Alerts are set for anything medium to critical.

Just to mention this is for antispyware although it should be similar to vulnerability protection.

Re: Exempt alerting for specific threat

OtakarKlier — Wed, 10 Jan 2018 22:57:00 GMT

Sorry, that is where my fingers were quicker than my brain. You are correct the severity cannot be changed. If you have a SIEM you can just use it for the alerts and silence the PAN.

Just a thought.

Re: Exempt alerting for specific threat

jvalentine — Wed, 10 Jan 2018 23:02:11 GMT

PAN-OS 8.0 introduced "Filtered Log Forwarding". This would allow you to further "tweak" the rule that generates e-mail notifications. You could easily exempt certain events from generating e-mails, regardless of severity. Read more about it here:

https://live.paloaltonetworks.com/t5/Community-Blog/Make-more-sense-using-filtered-log-forwarding/ba-p/146395

https://live.paloaltonetworks.com/t5/Tutorials/Tutorial-Filtered-Log-Forwarding/ta-p/145950

Re: Exempt alerting for specific threat

raji_toor — Thu, 11 Jan 2018 20:15:00 GMT

Thanks you guys, We hope to upgrade to 8 soon

Re: Exempt alerting for specific threat

ThomasBezak — Tue, 01 Oct 2024 15:37:45 GMT

Where would one do this in PANOS 11.X?