Suspicious DNS Query Action

[HartkentlyNua]

Hello PAN Community,

I would just like to know if its possible to edit or change the default action for a specific suspicious DNS query?

We have a situation here where what we wanted to happen is to drop all the packets for suspicious DNS query instead of resetting both connection.

Thank you in advance.

Regards,

Hartkently

[nchong]

Hi Hartkently,

In the vulnerability profile that you are using, you can click on the exception tab and search for the Threat that you want to change the action. On the action column you will then be able to change the action from "default (reset-both)" to "drop"

Regards,

Narong

[HartkentlyNua]

Hello Narong,

Thank you for that information, I certainly can change the default action there. however, the threats that we are looking for isn't there. please see the image below,

these are the kind of threats that we want change the action.

Thank  you.

Regards,

Hartkently

[HULK]

Hello Hartkently,

Do you have the "threat-ID" for those you want to change the default action...?

FYI:

Thanks

[HartkentlyNua]

Hello Hulk,

below is the traffic info of the threat that we want to change the action.

if i'm not mistaken, the ID on the threat details is the threat ID. I tried looking for it on the vulnerability protection and anti-spyware, but the only place i found it was in the DNS signatures and there no change or edit action there.

thank you.

regards,

hartkently

[HULK]

Hello Hartkently.

Yes you are correct, In case of spyware signature, the ID will be re-used by PAN firewall and you will not be able to change the default action.

Thanks

[HartkentlyNua]

HULK wrote:

Hello Hartkently.

Yes you are correct, In case of spyware signature, the ID will be re-used by PAN firewall and you will not be able to change the default action.



Thanks

Hello Hulk,

Thank you for that information. So there is now way we can change the default action for DNS signatures.

Regarding your last post, We would like to verify the purpose of Threat ID exceptions, what will happen to a specific threat if we include it on the exceptions?

Thank you very much.

Regards,

Hartkently

[HULK]

Hello Hartkently,

If you add an exception for a Threat ID, the traffic will be bypassed through the PAN firewall and signature will not trigger.

Thanks