- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
09-04-2024 02:39 AM
Hi All,
Can anyone show me how to troubleshoot this alert? or this alert is false positive?
SYSTEM ALERT : medium : Could not access threat vault
as per logs is only show 1 time only
Thank you
09-04-2024 05:14 AM
Hi @Fariq_Zaidi ,
This is a general alert that indicates the firewall was unable to connect to the threatvault.paloaltonetworks.com server. This is a database server in Palo Alto Networks for the firewall to pull information on threat IDs.
This does not affect the traffic through the firewall in any way, it's only informational. A possible reason for not being able to connect would be that the firewall cannot resolve the threatvault.paloaltonetworks.com server.
from the firewall CLI please run
> request resolve address api.threatvault.paloaltonetworks.com
> request resolve address threatvault.paloaltonetworks.com
Also if the traffic from the management interface is going through a firewall please check the traffic logs and verify that session to threatvault are not being dropped/denied.
Kind regards,
-Kim.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!