topic Re: False positive threat in General Topics

False positive threat

FarzanaMustafa — Tue, 20 Aug 2019 03:59:02 GMT

Hello,

PA-3020 is falsely identifying some adobe-creative-cloud-base traffic as being a threat. I can't add an exception for this as the log view does not contain a threat ID as it normally would for a threat. All of my dynamic updates are up to date.

The URL filtering profile is set to ‘alert’ for computer-and-internet-info (I have most of the categories set to ‘alert’).

The rule is set to ‘application default’ for the ports.

How to resolve this issue?

Re: False positive threat

Brandon_Wertz — Tue, 20 Aug 2019 12:42:23 GMT

If you can get a PCAP of the traffic. Open a ticket with support. They'll review the PCAP and get the signature updated to not alert on this false positive.

Re: False positive threat

S.Cantwell — Wed, 21 Aug 2019 21:24:20 GMT

I have not ever seen an application signature being false postive for a threat.

Now, it could be information inside the flow, using the app signature, but definitely not the app signature itself.

As for the URL category set to alert, then I would want to see a screen capture of the security profile group (if any) for your rule.

I am thinking you may have multiple URL filtering profiles and one of them is set to block.

But we would need see screen captures to show us this info.

Re: False positive threat

FarzanaMustafa — Thu, 22 Aug 2019 00:46:46 GMT

Thank you all for the response.

We had file blocking in place...disabled the file blocking and this has resolved the issue.