Threat False Positives?

[OtakarKlier]

Agreed, no one is perfect. I usually have a 24 hour threshold on any new signatures for app/threat.

[M.Eberhardt]

Same here. PaloAlto 5050 with Application and Threat Version 8077-5070.

Many critical threat log entrys with name-of-threatid eq 'Fallout Exploit Kit Detection' as false-positives.

[hshawn]

I looked at the js files being flagged. there must be something in them that is a close match. since these are not critial .js files I am leaving the block in place for now. Has anyone reported this to PA yet?

[mikebowen]

I just opened a case with PA to see what they say. So far it's creating an issue for one website we use, blocking a particular js file from loading and rendering the website inoperable. 

[BPry · Accepted solution]

FYI,

8078 was just released that is suppose to address the issue. 

[JasonLavetan]

8078 is working for us.

[SteveRuberti]

Same here getting pelted with .js alerts

[pkowalewski]

After instalation 8078 IPS/IDS - working fine....