Acting on Vulnerability threats

[merrydc]

When the Threat log shows a vulnerability, is this an actual attack of this vulnerability or is this something that is using software that has this vulnerability?

Trying to determine when to act on the vulnerability (i.e. block).

If a critical level vunerability is an actual attack then it would be no brainer to just block it but if the vulnerability is just potential to be an attack then blocking could be a problem for legitimate traffic.  I need help in understanding what the vulnerability log is telling me.

Thanks.

Crill

[NTAUSD]

---

@QLogicAdmin wrote:

Can this response be further clarified please?

sjain wrote:

When you see a threat log corresponding to a vulnerability, it means that our firewall detected some network traffic that could be intended to take advantage of the corresponding vulnerability i.e., an actual attack.

I take this to mean that just because there is traffic intended to attack a vulnerability does not mean that the system being attacked actually has that vulnerability.  Is that correct?

Thanks,

Keith

---

@QLogicAdmin I wish this point of clarification was made. This is the exact question that I have, even 10 years later.