Block FTP Brute Force Attemps - Threat ID 40001

[hnederstigt]

Hello,

I want to block Block FTP Brute Force Attemps.

The default rule in the PA alert only in theThreat log.

I added a new Vulnerabolity Protection Rule:

Action: Block

Host type: Any (also tried Server)

Category: brute-force

Severity: Any

CVE: Any

Vendor ID: Any

I placed the rule above al the default rules (see attachment).

If I simulate a ftp brute force attack I only see a alert message in the Threat log.

thanks in advance for your reply,

Hans

[drogers · Accepted solution]

Try changing the action to 'block-ip'.  Block will only block the packet/session related to the violation, which doesn't work very well for attacks based on cumulative attempts.

[fredallee]

What is the actual signature that is being enabled behind that exception rule? Is it a custom sig or the Palo Alto Networks ftp brute force sig?