topic Re: Flood event threat logs in General Topics

Flood event threat logs

SurajN — Sat, 17 Jul 2021 15:37:10 GMT

In this flood event count is showing, please what is the explanation of this Colum in threat logs report.

Re: Flood event threat logs

MP18 — Sat, 17 Jul 2021 17:17:33 GMT

Did you have DDos Protection enabled?

Seems you have that configured and now getting flooded and PA is recording them as threat with a Severity rating of critical under Threat logs.

Regards

Please open TAC case ASAP.

Re: Flood event threat logs

SurajN — Sun, 18 Jul 2021 05:02:30 GMT

Thank you for update. but i want explanation of count column .whta extactly showing in that column signature match packet or drop packet .so I'm little bit confused.

Re: Flood event threat logs

BPry — Mon, 19 Jul 2021 17:38:03 GMT

@SurajN,

The count is mapped to the repeat_count in the context that you are displaying, which is how the firewall essentially groups log files for flood alerts. So instead of getting 154 logs for your first entry, it'll only generate 1 log entry and the repeat count will tell you it was triggered for 154 sessions.