How to Analyse threats

[spriyadarshini]

Hi all,

Can anybody suggest me how to analyse threats that's been alerted by Palo alto device.

What is the analysis approach?
Please advice.

[ppatel]

Hi Priyadarshini,

When the Palo Alto device captures the threats, you see them in the threat logs. ( Monitor--> Threat logs)

In order to see the threat id of the threat being detected click on the small magnifying icon on the left first column to get the details of that particular threat.

Go to the Support portal,

https://support.paloaltonetworks.com

Go to threat database and enter the threat id.

You will get the details of the threat.

You can also get the pcap of the threat.

o to Objects--> Profiles---> Antivirus Profiles---> Enable packet capture

If you think it is not a threat (False positive)and is being detected please contact Palo Alto Networks Support in order to open a case and have the issue resolved.

Thanks

Parth

[spriyadarshini]

Thank you Patel

Your answer is very helpful.

I would also like to know what steps should I take to analyse the threat once its been reported by IDS i.e How to analyse that our internal system is vunerable or not.

Let me explain with an example.

say Http:IIS denial of service attack is reported by Palalto.Then what steps to be follow for analysis.Generally an alert provides us information on source ip,Destination ip,threat name,threat id,port number.....with these details how to proceed.

Thanks & regards

priyadarshini

[gafrol]

If you look at the threat details you'll find the link to the corresponding Microsft Bulletin. This link usually tells you which patches you need to apply in order to be protected from the threat.  rgds Roland