Action=Allow while NATDestinationIP=0.0.0.0

[JuanLondono1]

Hello,

I am not a firewall administrator I am an analyst who reports alerts on suspicious behavior based on indicators of compromise matches, mostly related to ransomware and IP addresses with bad reputation.

I have a big doubt because I always generate the alerts from the SIEM starting from the Action=allow field but I have noticed as you can see in the image that there are fields like "NATDestinationIP=0.0.0.0.0", "Application=incomplete", "SessionEndReason" or that simply from that malicious source Zero bytes were received.

Is it a false positive to report an Action=allow and NATDestinationIP=0.0.0.0.0? or is it something for the firewall administrators to check anyway?

Remember that I am not a firewall administrator nor an expert on them, I would appreciate your opinion in the clearest and least technical way possible.

Thanks

[BPry · Accepted solution]

@JuanLondono1,

The NATDestinationIP being 0.0.0.0 just means NAT isn't being applied, it shouldn't be utilized as any sort of guidance as far as whether something is a false-positive or not. The example that you provide simply indicates that the source IP was attempting to reach endpoints in your network that are public facing, but everything was either denied or it didn't receive any sort of response from the endpoint.

It seems likely from the logs that you've shared that you simply receive session-start and session-end logs and that there's an external security rule base entry that utilizes app-id that's set to service any. Not a best practice for external connections, but sometimes best practice and the real world don't match.