Block Botnet Traffic

[amansour]

Hi All;  Is there now or will there be a way to block botnet traffic based on thresholds.  A few customers have fireeye and are looking for the same type of heuristic detection and blocking.

Is there a way we can block unknown (Zero Day) botnets using the botnet piece?

[gswcowboy]

Botnet Reporting is a threat prevention feature. The PAN collates information from traffic, threat, URL logs to identify botnet-infected hosts. The report generated each day consists a list of infected hosts, description(why we believe the host is infected) and a Confidence level. You can configure the parameters in addition to the query indicating what traffic you'd like to see the botnet report on.

We do a very good job with zero day attacks through the combination of a few key capabilities:

We have a very close partnership with Microsoft via their MAPP program which gives us early access to most MS vulnerabilities, thus having signatures upon vulnerability disclosure. Our Threat Team is always proactively looking in the wild and researching new vulnerabilities. Our signatures are able to detect the attack against a vuln and not just the exploit. App-ID indirectly assists in detecting and prevention of new attacks as most uses high-risk apps as its mode of transportation. This will provide you another prevention method.

Regards,

Renato

[gswcowboy]

In addition, you may contact your local Sales SE to see if there's anything on the roadmap related to your inquiry.

Regards,

Renato