Paloalto Threat Details - Signatures

[ajrockn]

Could someone tell me when a signature gets detected in paloalto under Logs | Threat what None: means?

Thanks!

[syadav]

@ajrockn can you tell which field in the threat log, you are referring to ?

[ajrockn]

Its showing under the monitor tab | Logs | Threat and then under the Name column. Is this what your asking?

[syadav]

@ajrockn  The "None:" prefix seem to indicate the Threats (and corres. Thread ID) for domains which are identified (as suspicious) by  "Wildfire content signatures"

> The range is as follows :

Wildfire Suspicious DNS Signatures: 3800000 - 4000000

https://live.paloaltonetworks.com/t5/Threat-Articles/Threat-ID-Ranges-in-the-Palo-Alto-Networks-Cont...

Hence "None:" prefix  seems to be a notation placeholder for this threat ID range.You should be able to confirm this by your observation of the IDs in the logs.