SYSTEM ALERT : medium : Could not access threat vault

[Fariq_Zaidi]

Hi All,

Can anyone show me how to troubleshoot this alert? or this alert is false positive?

SYSTEM ALERT : medium : Could not access threat vault

as per logs is only show 1 time only

Thank you 

[kiwi]

Hi @Fariq_Zaidi ,

This is a general alert that indicates the firewall was unable to connect to the threatvault.paloaltonetworks.com server.  This is a database server in Palo Alto Networks for the firewall to pull information on threat IDs.

This does not affect the traffic through the firewall in any way, it's only informational. A possible reason for not being able to connect would be that the firewall cannot resolve the threatvault.paloaltonetworks.com server.

from the firewall CLI please run

> request resolve address api.threatvault.paloaltonetworks.com

> request resolve address threatvault.paloaltonetworks.com

Also if the traffic from the management interface is going through a firewall please check the traffic logs and verify that session to threatvault are not being dropped/denied.

Kind regards,

-Kim.