Submit a New Threat

[bkluth]

Hello,

My IDS has detected a new Angler signature on my network and it was allowed by my PA firewall. The traffic was allowed being the IDS is not inline. How do I submit packets for a threat update/addition?

[rcole]

Bkluth:

This forum is for custom signature creation; for official content requests for PAN supported content coverage, please open a support case through the traditional process and provide all data gathered.

If you're interested in a custom signature creation for this type of traffic, you can provide it here.

[bkluth]

Ok. Thank you for the clarification, although I cannot select a device to receive support for after selecting, "new case." There isn't a streamlined way to submit new threats? That's odd.

[rcole]

Bkluth:

The current method for reporting new threats and missed detection is to have a support case opened and ask to work with a threat specialist, where we will triage the issue and work with our research and development team to assist you in every way possible to close any gaps in coverage, provided that actionable data is available.

There are automated methods for submitting URL recategorization for malware sites, but currently working with the threat speciailist division of the support team designed to assist you is the most effective avenue.

If you are having trouble creating a case, Support <Support@paloaltonetworks.com> can assist you with this process, as our CSR folks are very experienced at addressing support accessibility issues.

[HITSSEC]

bkluth,

As a best practice we put all IP addresses hosting an exploit kit (Angler, Rig or Nuclear)  on a dynamic blocklist we do this upon notification of the IPS log event.  Looking at all traffic going to the site that is hosting the exploit kit sometimes shows other users going there.  The Impact to them is not known as there is sometimes no IPS event, no files coming down and sometimes no other network behaviors.  Our rationale is that there is nothing good at that IP address.

Phil