Vulnerability Signature action is Alert but traffic is getting reset both due to threat

[MP18]

In PA  traffic is blocked due to threat signature.

In threat  kogs it shows reset both.

When i check the signature it shows default action is alert only???

Why PA is resetting the connection when signature shows  action as  alert only???

[reaper]

Have you checked the security profile that is being hit? The default action for a specific signature may be alert, but the profile can be set to, for example, reset both on (all) high severity threats

[MP18]

Yes check the security profile it shows if alert is high then action is reset.

Why is this behaviour?

[reaper · Accepted solution]

This is how the administrator configured the profile