Is there a way for not letting conficker fill up the threat logs? Or an easy way to filter them out? I have 1000+ logs from 1 host on just a few hours and it is getting hard to see the other threats... Even in the ACC, I get a list full of conficker, nothing else. This is caused by every conficker URL being identified as a different threat ID.
You can use the anti-spyware profile and add the exception for DNS queries not to be populated in the threat logs by choosing the action allow.
Associate the profile to the rule which the traffic is hitting.
Syed R Hasnain
So I would need to create a new rule above the one that allows it at the moment with source IP the infected clients (otherwise I would not know when other clients have it)?
Also, the conficker threat has a lot of threat ID's, so setting all DNS queries to all would make other threats not show up in the logs?
Yes, you need to create a new rule above the one that allows it currently in order to apply the anti-spyware profile .
Below mentioned discussion may help you
You can use individual threat IDS and add them in the exception and set the action for them as allow as shown above in the snap shot..So in this way you will not be doing for all the threats but just for some individuals not to be populated in the threat logs.
Syed R Hasnain
Using individual threat ID'is is not an option I believe, since conficker seems to have a lot of different threat ID's. I was trying to filter them out of my threat logs but after removing 20-30 of them, there were still a lot more that needed to be filtered out.
It seems there is no reasonable way to "group" the conficker threat and filter it out.
Since conficker uses a generic url and PA creates a different ID for each of them, the exception list would grow rapidly every day. I am not sure about this, but it seems logical.
Hmmm, sorry, but disconnecting the affected system from the network and cleaning it is what I would consider the right approach..... And as a side effect the log entries will go away....
We are talking IT security right :-) ?
Just for clarification. You are not responsible for the guest network, but the traffic from the guest network is traversing your firewall ?
I would never allow a guest which is malware infected to use my network or traverse my firewall.
The traffic is in an isolated vlan which can only access the internet, not other internal subnets. A strict policy is in place to ensure this. I see no reason why this network should not be behind the main firewall.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!