MS-Update identified as a threat, there are no corresponding entries in the threat logs, URL filtering log or data filtering logs

[AkashThangavel]

Hi team,

Although MS-Update was flagged as a threat, there are no corresponding entries in the threat logs, URL filtering logs, or data filtering logs explaining the basis for its classification as a threat

The first three logs indicate that the traffic is passing without the security profiles

Why MS-update is identified as a threat??

with regards,

Akash Thangavel

Network Security Engineer

[akuzhuppilly]

Hello @AkashThangavel

To understand why certain ms-update traffic matches the criteria, you should examine the threat logs or URL filtering logs. Additionally, there is a known software issue (PAN-230250) that may cause this behavior. Please check if your case aligns with this issue.

You can find it in the PAN-OS 11.0.2 release notes, specifically under the "Known and Addressed Issues" section:

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-release-notes/pan-os-11-0-2-known-and-addressed...