Default threat ID correlation for action

[craigmueller]

Hi all,

I was searching for a while and could not find the answer to this question.

By default, does a Palo Alto block every instance a threat ID (that is enabled) is seen or does it wait until 1 threat ID hits 5 times in 1 minute (for example).

I would think it would be the former, but was searching for confirmation.

Thanks

[hshah]

Hello Craig,

If threat ID has default action RESET than it will stop in first instance. So, it depends on default action of threat.

There is a different case in Vulnerability. Lets say there is a vuln. for bruteforce. And Palo Alto conclude it bruteforce if there are more than 60 attempts in 1 minutes. So in these type of scenarios we check the hits.

Best thing is to understand threat details, firewall will behave case to case bases.

Regards,

Hardik Shah

[craigmueller]

Hardik,

Let's take HTTP Unauthorized Brute-force Attack (40031) for example and it's set to the default action of allow. You are saying, there would have to be 60 attempts within 1 minute before an alert would be created?

Do you have a link to these figures?

[hshah]

Hi Craig,

You are right about the behavior, certain number of attempts within 1 minute can trigger vulnerability 40031. And it will only generate a Threat log, because default action is Alert, not Reset.

Regards,

Hardik Shah

[kadak]

Hello craigmueller,

Here is the link you are looking for :

Trigger Conditions for Brute Force Signatures

Hope that helps!

Thanks and regards,

Kunal Adak

[craigmueller]

Thank you for the link.

Are there separate lists for each group of signatures? Like 40022 or 40008.

[hshah]

Hi Craig,

There may not be, but why do you need it?

Regards,

Hardik Shah

[craigmueller]

I was looking for more information on the threat IDs and what triggers the alerts.

[hshah]

Hi Craig,

Normally PAN doesnt disclose that information unless asked by specific customer for specific ID.

Regards,

Hardik Shah

[craigmueller]

ok, thanks everyone for the information