38407 (TLS Network Security Protocol Information Disclosure Vulnerability - ROBOT)
31127 (Multiple CPUs Side-Channel Information Disclosure Vulnerability - Spectre - Meltdown)
30276 (Multiple CPUs Side-Channel Information Disclosure Vulnerability - Spectre - Meltdown)
action is to 'alert' only. The last two vulns are severity 'critical'. Should we create exceptions and block these connections?
Solved! Go to Solution.
Most of the new alerts are set to 'alert' following introduction. While I can't speak for PA, I suspect this was due to past signatures causing issues in certain enviroments with the default action actually taking action on this traffic. You'll notice that most new signatures will be modified in the next one or two updates to a proper default action.
Personally I recommend that users completely override severity high and critical to something applicable to their enviroment; for example I simply reset all 'high' and 'critical' connections and have the syslog sent to my MineMeld server so that they can be blocked automatically unless they are included in my whitelist. If that isn't applicable to your enviroment, then I would highly suggest that you create exceptions and block all of the listed signatures.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!