topic Question Regarding Reporting in General Topics

Question Regarding Reporting

tfitzgerald — Tue, 11 Jun 2013 13:56:57 GMT

Hi All!

I'm responsible for Security Analysis at a Telecommunications company up in New England. We've recently deployed Palo Alto firewalls to all sites, and I am currently going through PDF Reports manually while we get Splunk installed.

One thing that confuses me is that occasionally, when doing a custom report, we get a traffic action I'm not familiar with. Typically we see 'alert' or 'drop all packets'. However, in one of our sites, we're seeing traffic labeled as 'reset-both' (image below, fifth line. This report is custom, created from the threat logs at this site).

Can someone explain what this action means in comparison to 'drop all packets'? Thanks!

-Travis Fitzgerald

Re: Question Regarding Reporting

gswcowboy — Tue, 11 Jun 2013 14:11:29 GMT

Reset-both: When selected as the action on the signature, the firewall will drop the packet and send a TCP reset to both client and server. This action is available in vulnerability protection exceptions.

Drop-all-Packets: When selected as the action on the signature, the firewall will drop every subsequent packet for that connection. This action is available in vulnerability protection exceptions.

Re: Question Regarding Reporting

tfitzgerald — Tue, 11 Jun 2013 14:16:04 GMT

Awesome, thanks. That's just what I needed.