Automatic attack block

[DPoppleton]

Occaisionally we get an attack from a single IP to one of our external servers where the attacker tries a whole bunch of known exploits. Is there anything like a "Zone Protection" for this type of attack? I'm looking for something where an external bad actor gets blacklisted for a period of time after it tries a number of expolits.

[bradk14]

there may be a more direct, better way, but what immediately comes to mind to me is if you have a threat prevention license and these are actual CVEs already known by PA, you can configure the vulnerability protection profile to have an action of Block IP which will shun the offending IP for up to an hour.

[kiwi]

Hi @DPoppleton,

I think you need DoS protection ?

A classified DOS protection profile allows the creation of a threshold that applies to a single source IP.

For example, a max session rate per IP can be created for all traffic matching the policy, then block that single IP address once the threshold is triggered for a certain amount of time which is configurable.

https://live.paloaltonetworks.com/t5/Featured-Articles/How-to-Set-Up-DoS-Protection/ta-p/71164

Hope it helps !

-Kiwi

[DPoppleton]

These attackers don't hit at a high rate, they just run through known vulnerabilities, most of which the Palo sees and blocks.  I would like a feature where if there are 5 hits against one IP of the known vulnerabilties then block all traffic for 1/2 an hour or so.

I'm thinking this might be a feature request.

[DPoppleton]

I'll see if I can find this....