Zone protection show wrong severity

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Zone protection show wrong severity

L1 Bithead

We are doing a lab and making test attacks and see if the PA can detect them, we have an interface in tap mode and it is doing the span, we did all the configurations in a PA-200 but when we lunch brute force attacks or sql injection,  the logs shown in the "threat" section appears "informational" for the severity column when it should appear another type of severity 

what can be causing this issue ?

 

1 accepted solution

Accepted Solutions

Great, thanks for the responde

by any chance, do you have any reference to this, any documentation? for future reference 

you know

thanks in advice !

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

@RCastro,

This has to do with you being in TAP mode. You can't take action on a threat when in TAP and therefore the vulnerabilities that are identified are 'informational' as to alert you that an action wasn't taken. On alerts not identified across TAP interfaces the severity would show accordingly. 

Great, thanks for the responde

by any chance, do you have any reference to this, any documentation? for future reference 

you know

thanks in advice !

Community Team Member

Hi @RCastro,

 

The following page repeats what BPry says :

 

tap-mode-deployments

 

It doesn't exactly say that all alerts are 'informational' but it does say that the firewall is not able to take action, such as block traffic or apply QoS traffic control when in TAP mode.

 

Cheers !

-Kiwi

LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.
  • 1 accepted solution
  • 2019 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!