Threat prevention subscription

[jdprovine]

Is anyone using the threat prevention subscription and how are they configuring it?  I know that there are things I want to block but currently I have only set it to alert. What is the best way to configure the security profiles to get the best result?

[_slv_]

Hi

Did You read https://live.paloaltonetworks.com/docs/DOC-3094

Please also think about Tips & Tricks: Using DNS Sinkhole to find Malicious Clients

How to Configure DNS Sinkhole

and of course CVE-2015-1635 and SSL decryption - is needed?

My Volnureability Ptorection Profile looks like:

and it's atached to security policy that allow users access to internet.

Regards

Slawek

[jdprovine]

Thanks yes I read that documentation and thanks for sharing the configuration of yours with me. Have you had any issues with blocking false positives

[_slv_]

I'm glad that I can help You.

Of course yes I had. This is normal situation - You must consider it. Read this community and You will see from time to time peopleas complaining about updates that was replaced in couples of hours by new version and so on.

Regards

Slawek

[BenjAudy.MTL]

Hi,

In my experience, I found it easier to configure a more aggressive profile for the DMZ because the traffic is much more predictable than what I see coming from inside the network. I work in a university and students use a lot of applications. Putting the action to alert is a good way to start. Eventually, you will see in the logs what you really want to block.

Benjamin

[jdprovine]

I took work at a university haven't really focused on the DMZ just trying to start the testing of the best method to approach the threat prevention. Just curious what In the logs keyed you in on what to block?

[BenjAudy.MTL]

I have a daily report of all the threats and their repeat count. I focus mostly on the critical and high severity threats, and I tend to spend more time on exploit kits and command and control traffic. I enable packet capture for most threats, so I can more easily find out if it's a false positive or not. I also like to tune the brute-force attack settings to block attackers while letting legitimate users in.

Benjamin

[jdprovine]

I will try that thanks