Gmail imap traffic allowed but reset as threat

[igor.shpak]

Hello everyone,

PA3220, it is already a couple of days as gmail imap traffic is allowed, but connection is reset as threat in Traffic Logs (see attached) Threat logs show nothing.

When checking traffic details, there is a strange app characteristics (see attached)

Any ideas?

[CosminM · Accepted solution]

Hello @igor.shpak 

Session end reason threat can be also from Data Filtering Security Profile and not only from Antivirus, Anti-Spyware or Vulnerability security profiles.

Please check also Data Filtering logs.

[igor.shpak]

Hello CosminM,

There is nothing in Data Filtering and URL filtering (sorry, pressed on Accept as Solution button by mistake)

[CosminM]

Hello @igor.shpak 

Please look into Detailed Log View by clicking on the Traffic Log's magnifying glass icon and check what was the reason to be classified as threat.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCQlCAO 

[igor.shpak]

This is what I did in the first place, pls see attached details.jpg from the first post

Basically it says

used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use,is-saas,is-hipaa,is-soc2

[CosminM]

I am suggesting you check the entire Detailed Log View information and not only Details section from that view.

What is "Session End Reason: threat"? 

[igor.shpak]

There is nothing else valuable in Detailed Log View

[igor.shpak]

Issue solved, looks like a specific email in gmail mailbox was causing it. After deleting some newly arrived emails from Gmail web, issue was resolved