topic Re: Filename field is empty on threat log in General Topics

Filename field is empty on threat log

Pradeepkumar064 — Fri, 20 Mar 2020 09:08:40 GMT

Dear Patrons,

There are two IPS in place with following configuration.

Objects > Security Profiles > Antivirus (Reset- Both)
Objects > Security Profiles > Anti-Spyware (no detail found)
Objects > Security Profiles > Vulnerability Protection (Reset- Both)

But we noticed that one IPS shows the filename in threat log (setup.exe) but in other IPS the filed is empty.

Threat name: (common on both the IPS) virus/win32.wgeneric

Dynamic updates are same on both the Firewalls.

Someone let me know what's odd in here?

Best Regards,

Pradeep

Re: Filename field is empty on threat log

reaper — Mon, 23 Mar 2020 12:42:08 GMT

hi pradeep

do you have a file blocking profile in place ?

a filename will only appear in the log where the filename is relevant

in a threat profile you are unlikely to encounter filenames as it is focussed on network layer attacks. antivirus and antispyware target 2 different types of threats so one may find something in a file whil ehte other doesn't match or finds something else

without more concrete examples of what you're facing it's difficult to give you a more solid answer

Re: Filename field is empty on threat log

Pradeepkumar064 — Wed, 25 Mar 2020 09:13:51 GMT

@reaper

Thanks for your kind response, let me collect the required details and reach out to you.

Best Regards,

Pradeepkumar

Re: Filename field is empty on threat log

Coxje — Wed, 08 Apr 2020 17:31:44 GMT

Hey Pradeepkumar064,

I am running into the same issue. This might help.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boOXCAY

Re: Filename field is empty on threat log

Pradeepkumar064 — Sat, 09 May 2020 04:47:41 GMT

@Coxje Thanks for the KB, really helpful.