Zone protection show wrong severity

[RCastro]

We are doing a lab and making test attacks and see if the PA can detect them, we have an interface in tap mode and it is doing the span, we did all the configurations in a PA-200 but when we lunch brute force attacks or sql injection,  the logs shown in the "threat" section appears "informational" for the severity column when it should appear another type of severity 

what can be causing this issue ?

[BPry]

@RCastro,

This has to do with you being in TAP mode. You can't take action on a threat when in TAP and therefore the vulnerabilities that are identified are 'informational' as to alert you that an action wasn't taken. On alerts not identified across TAP interfaces the severity would show accordingly. 

[RCastro · Accepted solution]

Great, thanks for the responde

by any chance, do you have any reference to this, any documentation? for future reference 

you know

thanks in advice !

[kiwi]

Hi @RCastro,

The following page repeats what BPry says :

tap-mode-deployments

It doesn't exactly say that all alerts are 'informational' but it does say that the firewall is not able to take action, such as block traffic or apply QoS traffic control when in TAP mode.

Cheers !

-Kiwi