topic Re: Virus/spware download blocked but no threat logs in General Topics

Virus/spware download blocked but no threat logs

faizankhurshid — Mon, 19 Feb 2018 18:27:02 GMT

When users are accessing internal portal then they are getting "Virus/spware download blocked" on browser with file name (althrough they are not accessing this file) but there is no virus/spyware logs in threat monitor tab.

Any pointers how to fix this?

Re: Virus/spware download blocked but no threat logs

Raido_Rattameister — Mon, 19 Feb 2018 19:00:09 GMT

You have identified that this block page is presented by Palo?

All your security policies have "Log at Session End" checked on Actions tab?

Do you see those threat events in ACC? Be aware ACC has 15 minute delay.

Re: Virus/spware download blocked but no threat logs

faizankhurshid — Mon, 19 Feb 2018 20:15:21 GMT

@Raido_Rattameister thanks.

You have identified that this block page is presented by Palo?

Yes becuase it is the default block page by Palo Alto firewall

All your security policies have "Log at Session End" checked on Actions tab? Yes I double checked that

Do you see those threat events in ACC? Be aware ACC has 15 minute delay.

I cannot see this here but I can see "others" with count 10

Re: Virus/spware download blocked but no threat logs

BPry — Mon, 19 Feb 2018 22:39:16 GMT

@faizankhurshid,

Have you taken a packet capture of the effected machine just to verify that they truthfully aren't trying to access the file-name indicated? It could be that the machine is infected with spyware/malware and they are trying to inject something into the browser page, or that they are getting redirected to a download page other than the page they were hoping to go to?

Re: Virus/spware download blocked but no threat logs

faizankhurshid — Tue, 20 Feb 2018 05:45:44 GMT

@BPry thanks but why I am not getting threat logs for this 😞

Re: Virus/spware download blocked but no threat logs

BPry — Tue, 20 Feb 2018 13:53:42 GMT

@faizankhurshid,

That would depend on your configuration; what does your security profile assigned actually look like?