topic Custom Vulnerability Not Showing Correctly In Reports in General Topics

Custom Vulnerability Not Showing Correctly In Reports

apackard — Mon, 20 Jan 2014 21:48:03 GMT

Hi, we're running 5.0.6 on our firewalls and 5.1.5 on Panorama.

I have some custom vulnerabilities that, when triggered, do not show up correctly in reports (Monitor Tab, ACC etc).

Only the reference number is show, not the name, description or assigned risk.

We have had this issue since v4, and had hoped that the v5 upgrade would fix, but still experience it.

Is this something that is expected to occur? Or do we have a corruption somewhere?

Many Thanks

Re: Custom Vulnerability Not Showing Correctly In Reports

apackard — Mon, 20 Jan 2014 21:50:50 GMT

Note: Signatures are defined in Panorama and pushed to the PA's.

The threat is also reported correctly on the firewalls themselves.

Rgds

Re: Custom Vulnerability Not Showing Correctly In Reports

Mystique — Mon, 20 Jan 2014 23:22:23 GMT

Hello apackard,

Can you please attach the snapshot of the custom report created on the Panorama ? Please verify that the selected columns under the report includes application name, risk and threats. Also, please click on Run now under the custom reports and make sure the report have those custom vulnerabilities that were triggered and reported correctly on the firewalls and Panorama.

Thanks

Re: Custom Vulnerability Not Showing Correctly In Reports

apackard — Tue, 21 Jan 2014 18:02:14 GMT

Here you go. I may have reported one slight inaccuracy:-

Details in the Threat Logs show the ID only (#1), as they do in the ACC tab (#2). However when running a report (#3) the proper name is shown:-

Re: Custom Vulnerability Not Showing Correctly In Reports

Phoenix — Tue, 21 Jan 2014 21:42:41 GMT

Hello Apackard,

Below is the threat logs taken from 5.0.10 firewall. We can see the Threat names in the Threat logs. We have to enable the column "Name" and we should see it.

Hope this helps !

Re: Custom Vulnerability Not Showing Correctly In Reports

HITSSEC — Wed, 22 Jan 2014 01:56:00 GMT

Hello Apackard,

We have seen the issue since PAN OS ver 4. This only happens with custom signatures in that the signature id is passed from the PA device to panorama but not the vulnerability name associated with the id. We have even tried defining the custom vulnerability signatures in Panorama with the desired descriptive names as in the PA appliance. Still no luck. A ticket into support at the time came back with that's the way it works (Custom vulnerability names are not passed across in the logs from the PA device to Panorama)

Phil