Multiple events "A Successful login from TOR"

[AndreSilva]

Hi,

We are seeing a lot of events from CORTEX "A Successful login from TOR".  Anyone else with this problem?

Seems to be a bug.

[seth-ultradent]

Yes, registered here just to confirm I'm not the only one

[keevang]

We're seeing the same thing as well.  Still trying to get confirmation from Palo Alto.

[AndreSilva]

We have a Palo Alto partner that told it is a false-positive and the events started when this BIOC was update, but it will be good a confirmation from Palo Alto

[JoelDBooth]

Seeing the same thing. Started about hour and a half ago. Makes no sense to us. Opened a case with support but haven't been contacted yet. Looks like a BIOC rule issue to me.

[Rapha]

We were seeing the exact same things but the alerts stopped about 20 min ago.

[JoelDBooth]

Looks like it is this BIOC update that has caused the problem. Info on the update here.

https://live.paloaltonetworks.com/t5/cortex-xdr-articles/content-release-notes/ta-p/257570

[MartinCimone]

Same here.  No Official answer yet from PaloAlto Support

[RonaldWeiss]

Same here...

[anlynch]

Hi everyone!

Thanks for reaching out to LIVEcommunity!

It appears that you guys are aware of an ongoing issue at the moment.  It appears a bad BIOC rule went out with a recent Content Update.  Our support teams are aware and they are currently working on the issue.

Right now there's nothing you need to do.  You don't need to start a support case.  

As the situation changes I'll try to make sure that this thread is updated with any new information.

[AndersonStiven_Vasquez]

Hi Anlynch

Thank you for your answer.

Could you share the Paloalto's official communication in this threat when it's resolved?

Thank you in advance,

Best regards.

[cyberjake22]

We had the same issue. 15 alerts from 3:06PM to 4:03PM CST.

[AUNet_Wolf]

Love getting woken by the NOC for false positives

116 Alerts from 06:09 to 07:23 AEST (UTC+10)

[ZeeD]

Confirmed bug by Palo Alto - Cortex support !

[Pramita]

We did see this issue today creating continuous alerts for this BIOC rule for almost 2 hours. The community sharing really helped.