SYSTEM ALERT : medium : Could not access threat vault

[Fariq_Zaidi]

Hi All,

Can anyone show me how to troubleshoot this alert? or this alert is false positive?

SYSTEM ALERT : medium : Could not access threat vault

as per logs is only show 1 time only

Thank you 

[kiwi · Accepted solution]

Hi @Fariq_Zaidi ,

This is a general alert that indicates the firewall was unable to connect to the threatvault.paloaltonetworks.com server.  This is a database server in Palo Alto Networks for the firewall to pull information on threat IDs.

This does not affect the traffic through the firewall in any way, it's only informational. A possible reason for not being able to connect would be that the firewall cannot resolve the threatvault.paloaltonetworks.com server.

from the firewall CLI please run

> request resolve address api.threatvault.paloaltonetworks.com

> request resolve address threatvault.paloaltonetworks.com

Also if the traffic from the management interface is going through a firewall please check the traffic logs and verify that session to threatvault are not being dropped/denied.

Kind regards,

-Kim.

[Fariq_Zaidi]

Hi Kim,

can you let me know what happen if the firewall not able to access the threat vault? is the traffic will still able to block or drop threat?

Thank you

[kiwi]

Hi @Fariq_Zaidi ,

Yes, if your firewall has downloaded/installed a dynamic content update (for example Antivirus or Apps & Threats) then it has those signatures to block threats.

Hope this helps,

-Kim.