Antivirus Decoder Action

[mrsoldner]

I feel silly asking this - wouldn't you want a deny on any decoder where a virus is detected rather than allowing the traffic and just throwing an alert?

[HULK]

Hello mrsoldner,

As per my understanding, action is taken based on the different severity level of that virus. If that virus is having typically very little impact /or no impact on an organization's infrastructure. Then the action will be set to "alert".

Thanks

[jtyler]

Setting a block for viruses on smtp will cause the originating server to keep trying to relay the email until a timeout occurs. This could potentially cause a lot of unwanted traffic pointed at your smtp server that is getting blocked over and over by the firewall. That may still be preferred to allowing a virus in via smtp, but it's just something to be aware of.

[HULK]

Hello jtyler,

It's a good example.

Thanks

[mrsoldner]

Is there somewhere that Virus severity is noted? 

[mrsoldner]

jtyler wrote:

Setting a block for viruses on smtp will cause the originating server to keep trying to relay the email until a timeout occurs. This could potentially cause a lot of unwanted traffic pointed at your smtp server that is getting blocked over and over by the firewall. That may still be preferred to allowing a virus in via smtp, but it's just something to be aware of.

Good point, I did some digging and found this:  Threat Prevention Deployment Tech Note

It looks like some intelligence is built in for SMTP and will send back a 541 response so that the other side doesn't keep resending the email.  POP and IMAP however don't have any intelligence built in.  So, per the doc:

Note: The reason why SMTP, POP3 and IMAP have the default action set to ALERT is because in most cases there is 
already a dedicated Antivirus gateway solution in place for these protocols. Specifically for POP3 and IMAP, it is not 
possible to clean files or properly terminate an infected file-transfer in-stream without affecting the entire session. 
This is due to shortcomings in these protocols to deal with this kind of situation.

Thanks for the help.  I think we'll stick with the defaults for now and potentially ratchet up SMTP.

[hshah]

Hello Mrsoldner,

Every virus signature has different severity. You can find that information from following link. Select type as a "virus".

https://threatvault.paloaltonetworks.com/

You need to feed either virus name or ID.

Regards,

Hardik Shah

[mrsold]

hshah wrote:

Hello Mrsoldner,

Every virus signature has different severity. You can find that information from following link. Select type as a "virus".
https://threatvault.paloaltonetworks.com/

You need to feed either virus name or ID.

Regards,
Hardik Shah

Thanks hshah - I've never seen a severity included with a virus though which is why I'm puzzled.  For example:

ID: 3088393

The threat vault just calls it a virus.  It came in via SMTP (which by default, the action is alert) however in the logs it shows it was blocked.

Just making sure I fully understand. 

[hshah]

Hello Mrsold,

My bad, its vulnerability which has sev not anti-virus. Thanks for correcting me.

Regards,

Hardik Shah

[mrsold]

HULK wrote:

Hello mrsoldner,

As per my understanding, action is taken based on the different severity level of that virus. If that virus is having typically very little impact /or no impact on an organization's infrastructure. Then the action will be set to "alert".

Thanks

HULK could you clarify?  My antivirus decoder for SMTP is set to "alert" for WildFire and Threat however I am seeing Virus blocks for SMTP traffic. 

[panos]

you use alert profile but you see block logs ? that is interesting.

[pulukas]

Another reason the action may be set to alarm rather than deny as the default action is the possibility of false positives.  Palo Alto is pretty good about only setting drop/reset actions to signatures are have virtually no false positives.  You don't want to be blocking too many legitimate sessions.

The alarm option then can give you a report on suspects that can be researched and confirmed.  If you subsequently find that virtually all the alarms are real then you have the option to change the action to a deny/reset instead of alarm.

[mrsoldner]

panos wrote:

you use alert profile but you see block logs ? that is interesting.

Yeah,  very interesting indeed.  I need to do some more digging...

[mrsoldner]

Yeah panos and HULK - Interesting indeed:

Av Profile:

[mrsoldner]

So, If i'm reading this right - the attachment was blocked but the email allowed?