Virus/spware download blocked but no threat logs

[faizankhurshid]

Hi

When users are accessing internal portal then they are getting "Virus/spware  download blocked" on browser with file name (althrough they are not accessing this file) but there is no virus/spyware logs in threat monitor tab.

Any pointers how to fix this?

[Raido_Rattameister]

You have identified that this block page is presented by Palo?

All your security policies have "Log at Session End" checked on Actions tab?

Do you see those threat events in ACC? Be aware ACC has 15 minute delay.

[faizankhurshid]

@Raido_Rattameister thanks. 

You have identified that this block page is presented by Palo? 

Yes becuase it is the default block page by Palo Alto firewall 

All your security policies have "Log at Session End" checked on Actions tab? Yes  I double checked that

Do you see those threat events in ACC? Be aware ACC has 15 minute delay. 

I cannot see this here but I can see "others" with count 10

[BPry]

@faizankhurshid,

Have you taken a packet capture of the effected machine just to verify that they truthfully aren't trying to access the file-name indicated? It could be that the machine is infected with spyware/malware and they are trying to inject something into the browser page, or that they are getting redirected to a download page other than the page they were hoping to go to? 

[faizankhurshid]

@BPry thanks but why I am not getting threat logs for this 😞

[BPry]

@faizankhurshid,

That would depend on your configuration; what does your security profile assigned actually look like?