Continuous Threat Logs Showing Management Server IP as Source

[Satyak]

Hi Friends,

I am facing an issue with my PA-440 firewall after the recent update to 11.1.13 i have been encountring an continous threat logs generation for the threat id : 765344918 with the threat type as : spyware and the threat id name as : generic:vikingindustries.in and the destinations as : 8.8.8.8 / 4.2.2.2 respectively

The service route is configured as use management interface only. so be default all the services in the firewall will use management interface. 

These threat logs are coming under dns-base category and these are getting generated every minute even though the action is set to drop but i  want to understand why these are specifically getting generated from the firewalls management ip is it an exepected behaviour or do i need to make any changes.

Looking forward for your suggestions.

Regards

Satya Kalyan

[Raido_Rattameister]

Something in your network is trying to resolve vikingindustries.in to IP.

Are you using DNS Proxy feature in the firewall?

Set up DNS sinkhole and see what internal machines try to access sinkhole IP. 

This allows you to identify which internal machine is responsible for connections to vikingindustries.in

[Satyak]

Hi Raido 

The domain vikingindustries.in is an intenal know domain and additionally i will try to setup the dns sinkhole and look into this. Additionally why only these logs are coming ony after the PAN OS upgrade because the domian vikingindustries.in in the internal networks for more than 1 year and the domain is also got categoriezed as malware in the paloalto.

Regards

Satya Kalyan 

[Raido_Rattameister]

Maybe your firewall upgrade happened to be around same time when threat id 765344918 was created and that is why suddenly started seeing it.

If it is internally used domain and you are not responsible for public one, then you can add exception.

Objects / Security Profiles / Anti-Spyware / <Anti-Spyware Profile> / DNS Exceptions