ACC shows Threat Hit with Severity as Medium while ThreatLogs shows Severity as Informational

[Alex_Graser]

Hi All,

currently we have a Test-device from PaloAlto for evaluation (PA-5020, PANOS 5.0.2, AV-Sig 946-1309, App&Threats-Version 357-1692, URL-Filter 4044).

Today I took a look at Threat Prevention Summary in ACC and saw a few Hits "Trojan-Ransom.foreign:madeleine.adclear.net" ID=4091550 with Severity "Medium".

Then I was searching in ThreatLogs and filterd to show only events with severity mediu, high or critical. First I was wondering why I didn´t see the hits which were shown in ACC but then I applied another filter, this time to show only the Attacker (which i got also from ACC) and with this filter I found the hit in the ThreatLog.

BUT: in ThreatLog this Hit was with severity "Informational".

So I´m wondering why is the severity different in ACC from that in ThreatLog? I assume the Severity comes from the Signature itself, so it should be the same severity in ACC as well as in ThreatLogs. Or am I missing something?

It´s important for me to understand, because I have AntiSpyware-Profile which does a PacketCapture on Severity from Medium to Critical. Since the ThreatLog shows Severity "Informational" no capture was taken.

Any hints on this would be usefull for me!

Thanks a lot!

Alex.

[sdurga]

The ACC and the threat logs should represent the same information. I have checked my lab device and it is working as expected as shown below.

Would it be possible for you to attach a screenshot of yours ?

Thanks,

Sandeep T

[Alex_Graser]

Hi,

I will take screenshots and will post it on monday.

thanks,

alex.

[Alex_Graser]

Hi Sandeep,

Now I´m able to post my screenshots.

First from ACC:

Second from Monitor:

As you can see in the Threatlogs, the same type of Spyware´s severity is "Informational". Since Friday afternoon suddenly it is "Medium".

In ACC it was always shown with Severity "Medium"

Maybe there was an update in the last days?

Thanks,

Alex.

[mikand]

Is it the same threatid in both cases?

I get no hits at all in threat vault when searching for Trojan-Ransom.foreign:medeleine.adclear.net (or part of that name) - and yes I did try to search in all dbs (vuln, spyware, virus).

[Alex_Graser]

Yes, it is the same threatid (id 4091550) in both cases!

I also get no hit when searching the db´s. BTW, its type is shown as "Spyware" in both ACC and Threatlogs.

Greetings,

Alex.

[Alex_Graser]

Maybe, it´s because ThreatDatabase states "Database reflects antivirus version 947 and threats version 356.", but our PA-5020 runs App&Threats DB Version 357-1693?

[Alex_Graser]

ThreatDatabase now reflects antivirus version 954 and threats version 358

But I still can´t find ID 4091550.

Anyone has an idea?

Thanks,

Alex.