session end threat

[jdprovine]

I had a user that was not able to connect through a mapped drive to one of our servers. Looked in the monitor and it said session end reasson threat but it didn't identify anything about the threat not cve no ID information

[Raido_Rattameister]

Look what the session id is.

Go to threat log and filter out this session id to find the cause.

Traffic log will not tell you the cause.

[reaper]

Have you tried looking in the detailed log view?

if you click the little magnifying glass next to the traffic log, it will open a detailed view. In the detailed view, at the bottom, the correlated logs for this session should also be included (threats, file blocking, ...). If you click one of these correlated logs, the detail view will switch to that log entry

hope this helps ! 🙂

[Roby_Sreejith]

See detailed logs and share the results

[jdprovine]

Yes I also found out that there was a bug involved with one of the threats and had to make an exception