Any defenses against slow HTTP Post DOS?

[JKoss]

http://www.darkreading.com/vulnerability_management/security/attacks/showArticle.jhtml?articleID=228...

Just wondering if there is anything our PA can do to protect from this kind of exploit?

Jim

[migration]

Hi Jim,

We are looking into this. I'll send an update when I have more information.

Thanks,
Sandeep

[JKoss]

Anything happening with this?

[mikand]

There are a few candidates in the threatvault:

This event indicates that someone want to exhaust the apache resources, as described by slowloris.

https://threatvault.paloaltonetworks.com/Home/ThreatDetail/40018

This event indicates a DOS attack against IIS server.

https://threatvault.paloaltonetworks.com/Home/ThreatDetail/40019

Among others.

There is also zone-protection but I cant find any good setting regarding "slow" connections in there (only stuff like number of concurrent sessions etc).

Edit: Hopefully these docs might be helpful:

https://live.paloaltonetworks.com/docs/DOC-1746

https://live.paloaltonetworks.com/docs/DOC-3767