Paloalto detected vulnerability traffic but the traffic is allowed

[saighanasyam42]

Hi Guys,

SIEM tool - QRadar

Firewall - Paloalto

Received one exploit alert in our siem console

Source ip is internal workstation reaching to external remote public ips like yahoo,aws

alert name is exploit events across multiple targets containing generic prompt xss vulnerability

Paloalto detected  the vulnerability traffic and sent those logs to SIEM however the traffic is allowed in paloalto
what might be the reason?

[reaper]

have you checke dthe threat log? there should be an associated action to the threat which is tied to the configuration of the security profile assovciated with the security policy that allows the session to start

if the threat is of severifty 'informational; for example, the default action is typically 'alert' which simply generates a log but takes no action