Action=Allow while NATDestinationIP=0.0.0.0

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Action=Allow while NATDestinationIP=0.0.0.0

L0 Member

Hello,

 

I am not a firewall administrator I am an analyst who reports alerts on suspicious behavior based on indicators of compromise matches, mostly related to ransomware and IP addresses with bad reputation.

 

I have a big doubt because I always generate the alerts from the SIEM starting from the Action=allow field but I have noticed as you can see in the image that there are fields like "NATDestinationIP=0.0.0.0.0", "Application=incomplete", "SessionEndReason" or that simply from that malicious source Zero bytes were received.

Is it a false positive to report an Action=allow and NATDestinationIP=0.0.0.0.0? or is it something for the firewall administrators to check anyway?

Remember that I am not a firewall administrator nor an expert on them, I would appreciate your opinion in the clearest and least technical way possible.

 

Thanks

 

 

JuanLondono1_0-1714499856570.png

 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

@JuanLondono1,

The NATDestinationIP being 0.0.0.0 just means NAT isn't being applied, it shouldn't be utilized as any sort of guidance as far as whether something is a false-positive or not. The example that you provide simply indicates that the source IP was attempting to reach endpoints in your network that are public facing, but everything was either denied or it didn't receive any sort of response from the endpoint.

 

It seems likely from the logs that you've shared that you simply receive session-start and session-end logs and that there's an external security rule base entry that utilizes app-id that's set to service any. Not a best practice for external connections, but sometimes best practice and the real world don't match. 

View solution in original post

1 REPLY 1

Cyber Elite
Cyber Elite

@JuanLondono1,

The NATDestinationIP being 0.0.0.0 just means NAT isn't being applied, it shouldn't be utilized as any sort of guidance as far as whether something is a false-positive or not. The example that you provide simply indicates that the source IP was attempting to reach endpoints in your network that are public facing, but everything was either denied or it didn't receive any sort of response from the endpoint.

 

It seems likely from the logs that you've shared that you simply receive session-start and session-end logs and that there's an external security rule base entry that utilizes app-id that's set to service any. Not a best practice for external connections, but sometimes best practice and the real world don't match. 

  • 1 accepted solution
  • 1110 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!