Antivirus Decoder Action

Reply
Highlighted
L0 Member

Antivirus Decoder Action

I feel silly asking this - wouldn't you want a deny on any decoder where a virus is detected rather than allowing the traffic and just throwing an alert?

Tags (2)
Highlighted
L7 Applicator

Re: Antivirus Decoder Action

Hello mrsoldner,

As per my understanding, action is taken based on the different severity level of that virus. If that virus is having typically very little impact /or no impact on an organization's infrastructure. Then the action will be set to "alert".

Thanks

Highlighted
L1 Bithead

Re: Antivirus Decoder Action

Setting a block for viruses on smtp will cause the originating server to keep trying to relay the email until a timeout occurs. This could potentially cause a lot of unwanted traffic pointed at your smtp server that is getting blocked over and over by the firewall. That may still be preferred to allowing a virus in via smtp, but it's just something to be aware of.

Highlighted
L7 Applicator

Re: Antivirus Decoder Action

Hello jtyler,

It's a good example. :smileyhappy:

Thanks

Highlighted
L0 Member

Re: Antivirus Decoder Action

Is there somewhere that Virus severity is noted? 

Highlighted
L0 Member

Re: Antivirus Decoder Action

jtyler wrote:

Setting a block for viruses on smtp will cause the originating server to keep trying to relay the email until a timeout occurs. This could potentially cause a lot of unwanted traffic pointed at your smtp server that is getting blocked over and over by the firewall. That may still be preferred to allowing a virus in via smtp, but it's just something to be aware of.

Good point, I did some digging and found this:  Threat Prevention Deployment Tech Note

It looks like some intelligence is built in for SMTP and will send back a 541 response so that the other side doesn't keep resending the email.  POP and IMAP however don't have any intelligence built in.  So, per the doc:

Note: The reason why SMTP, POP3 and IMAP have the default action set to ALERT is because in most cases there is

already a dedicated Antivirus gateway solution in place for these protocols. Specifically for POP3 and IMAP, it is not

possible to clean files or properly terminate an infected file-transfer in-stream without affecting the entire session.

This is due to shortcomings in these protocols to deal with this kind of situation.

Thanks for the help.  I think we'll stick with the defaults for now and potentially ratchet up SMTP.

Highlighted
L6 Presenter

Re: Antivirus Decoder Action

Hello Mrsoldner,

Every virus signature has different severity. You can find that information from following link. Select type as a "virus".

https://threatvault.paloaltonetworks.com/

You need to feed either virus name or ID.

Regards,

Hardik Shah

Highlighted
Not applicable

Re: Antivirus Decoder Action

hshah wrote:

Hello Mrsoldner,

Every virus signature has different severity. You can find that information from following link. Select type as a "virus".

https://threatvault.paloaltonetworks.com/

You need to feed either virus name or ID.

Regards,

Hardik Shah

Thanks hshah - I've never seen a severity included with a virus though which is why I'm puzzled.  For example:

ID: 3088393

The threat vault just calls it a virus.  It came in via SMTP (which by default, the action is alert) however in the logs it shows it was blocked.

Just making sure I fully understand. 

Highlighted
L6 Presenter

Re: Antivirus Decoder Action

Hello Mrsold,

My bad, its vulnerability which has sev not anti-virus. Thanks for correcting me.

Regards,

Hardik Shah

Highlighted
Not applicable

Re: Antivirus Decoder Action

HULK wrote:

Hello mrsoldner,

As per my understanding, action is taken based on the different severity level of that virus. If that virus is having typically very little impact /or no impact on an organization's infrastructure. Then the action will be set to "alert".

Thanks

HULK could you clarify?  My antivirus decoder for SMTP is set to "alert" for WildFire and Threat however I am seeing Virus blocks for SMTP traffic. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!