topic Re: Threat prevention subscription in General Topics

Threat prevention subscription

jdprovine — Tue, 05 May 2015 13:06:48 GMT

Is anyone using the threat prevention subscription and how are they configuring it? I know that there are things I want to block but currently I have only set it to alert. What is the best way to configure the security profiles to get the best result?

Re: Threat prevention subscription

_slv_ — Wed, 06 May 2015 06:42:42 GMT

Did You read https://live.paloaltonetworks.com/docs/DOC-3094

Please also think about Tips & Tricks: Using DNS Sinkhole to find Malicious Clients

How to Configure DNS Sinkhole

and of course CVE-2015-1635 and SSL decryption - is needed?

My Volnureability Ptorection Profile looks like:

and it's atached to security policy that allow users access to internet.

Regards

Slawek

Re: Threat prevention subscription

jdprovine — Wed, 06 May 2015 12:29:39 GMT

Thanks yes I read that documentation and thanks for sharing the configuration of yours with me. Have you had any issues with blocking false positives

Re: Threat prevention subscription

_slv_ — Wed, 06 May 2015 12:56:42 GMT

I'm glad that I can help You.

Of course yes I had. This is normal situation - You must consider it. Read this community and You will see from time to time peopleas complaining about updates that was replaced in couples of hours by new version and so on.

Regards

Slawek

Re: Threat prevention subscription

BenjAudy.MTL — Wed, 06 May 2015 13:45:13 GMT

Hi,

In my experience, I found it easier to configure a more aggressive profile for the DMZ because the traffic is much more predictable than what I see coming from inside the network. I work in a university and students use a lot of applications. Putting the action to alert is a good way to start. Eventually, you will see in the logs what you really want to block.

Benjamin

Re: Threat prevention subscription

jdprovine — Wed, 06 May 2015 13:53:27 GMT

I took work at a university haven't really focused on the DMZ just trying to start the testing of the best method to approach the threat prevention. Just curious what In the logs keyed you in on what to block?

Re: Threat prevention subscription

BenjAudy.MTL — Mon, 11 May 2015 02:40:08 GMT

I have a daily report of all the threats and their repeat count. I focus mostly on the critical and high severity threats, and I tend to spend more time on exploit kits and command and control traffic. I enable packet capture for most threats, so I can more easily find out if it's a false positive or not. I also like to tune the brute-force attack settings to block attackers while letting legitimate users in.

Benjamin

Re: Threat prevention subscription

jdprovine — Mon, 11 May 2015 12:58:14 GMT

I will try that thanks