topic Palo Dual Action on Same Malicious Domain in General Topics

Palo Dual Action on Same Malicious Domain

Joshan_Lakhani — Mon, 18 Jan 2021 19:08:16 GMT

We have found in the logs, Malicious DNS queries are being blocked but few of them are in Alert State. however the Domain is marked as a malicious in DNS signature at Threat Vault.

Can you please elaborate why paloalto having dual action on same malicious domain.

Re: Palo Dual Action on Same Malicious Domain

reaper — Mon, 18 Jan 2021 22:55:22 GMT

do you happen to have multiple vsys or could these 'alert' ones be hitting a different rule altogether ?

Re: Palo Dual Action on Same Malicious Domain

Joshan_Lakhani — Tue, 19 Jan 2021 06:33:23 GMT

@reaper we are not using Vsys moreover it's hit on same policy. Furthermore when we check the other domains we are still see that some time paloalto it's show alert and 90% is sinkhole please suggest.

Re: Palo Dual Action on Same Malicious Domain

Joshan_Lakhani — Fri, 22 Jan 2021 20:09:45 GMT

@reaper @BPry @MP

In our case, if the get the IP address of the malicious domain and it generates the “alert” on the firewall.

One the second time it will identify its malicious domain then the query will send to the sinkhole.

DNS sinkhole can be used to identify infected hosts on a network where there is an internal DNS Server in-route to the firewall that causes the reference of the original source IP address of the host that first originated the query to be lost (the query is received by the Internal DNS Server, and the internal DNS Server sources a new query if the name-to-IP resolution is not locally cached).

The things we have understood by your assistance but we could not found any document having the same use case or actual flow of DNS or its cache how they works.

Can you please suggest any document or use case.