Exempt alerting for specific threat

[raji_toor]

We have an open wifi network and do see lot of coinhive spyware threat alerts. Recently a user genrated in excess 30000 email alerts for CoinHive JavaScript Detection. We don't want to block the user and also the external IP is not single one. Firewall is set to reset-bot on detection. We just don't want to see this email alert, is there a workaround to disable alert on a specific spyware.

[OtakarKlier]

Hello,

Yes there is. Just use the exception tab to filter the one you dont want to see out. Set it something lower and change the action.

Hope that helps.

[raji_toor]

How would you change the severity of threat under exceptions? SMTP Alerts are set for anything medium to critical.

Just to mention this is for antispyware although it should be similar to vulnerability protection.

[OtakarKlier]

Sorry, that is where my fingers were quicker than my brain. You are correct the severity cannot be changed. If you have a SIEM you can just use it for the alerts and silence the PAN.

Just a thought.

[jvalentine · Accepted solution]

PAN-OS 8.0 introduced "Filtered Log Forwarding".  This would allow you to further "tweak" the rule that generates e-mail notifications.  You could easily exempt certain events from generating e-mails, regardless of severity.  Read more about it here:

https://live.paloaltonetworks.com/t5/Community-Blog/Make-more-sense-using-filtered-log-forwarding/ba...

https://live.paloaltonetworks.com/t5/Tutorials/Tutorial-Filtered-Log-Forwarding/ta-p/145950

[raji_toor]

Thanks you guys, We hope to upgrade to 8 soon

[ThomasBezak]

Where would one do this in PANOS 11.X?