04-14-2016 02:26 AM
Hello,
How Palo Alto choose action for correlated events? For example we have several medium severity events with summary Host visited known malware URL. In some events action is alert and some events action is block-url.
04-14-2016 11:56 AM
Hi...I believe the action block-url is done by your URL filtering policy. The correlated events are indicators of potential compromised hosts on the network that generated activity matching the Correlation objects. The Correlation objects are defined and developed by the Palo Alto Networks Threat Research team.
04-14-2016 11:56 AM
Hi...I believe the action block-url is done by your URL filtering policy. The correlated events are indicators of potential compromised hosts on the network that generated activity matching the Correlation objects. The Correlation objects are defined and developed by the Palo Alto Networks Threat Research team.
04-14-2016 11:26 PM
Hi,
oh yes that's the reason now i get it.
thanks a lot rmonvon!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
