ThreatID references, or lack thereof

[MCmgt]

I frequently come across threat notifications where the info in the Threat DB is so sparse as to make the notification useless.

Take for example my threatid du jour, 13742.

"This signature detects NUCLEAR.Gen Command and Control Traffic."

That's it. Try googling around to see what this is all about.

How do you go about filling in the missing blanks in the ThreatDB?

What do I do, blindly reimage the machine(s) because I have no way of ruling out a false positive?

[Dz3015 · Accepted solution]

Try searching the Threat Vault for more information:

https://threatvault.paloaltonetworks.com/

For example, I did a search for "NUCLEAR" and got two hits

[MCmgt]

Thanks. I had only looked in the Spyware category (by threatid).