Strange IP exiting our network and erasing its logs

[UNIRIO]

Hi everyone! Good Afternoon,

I'm from Brazil, and my organization have two appliances PA 3220 in HA. This morning we've  noticed some suspicious traffic exiting our network with IPv6 ::b638:2a0a:ffff:0 (for example), there was more than one those IPv6. The payload was huge, something about 4.2GB. This can be an exfiltration data attack? Could anyone help us with this doubt?  

Sincerely,

André Luiz Guimarães

[${userLoginName}]

Do you have machine in your network with IP 10.42.56.182 ?

This is what  ::b638:2a0a:ffff:0 refers to in IPv4 format.

Every now and then Palo has a bug where IPv4 IPs show up as IPv6 in reports.

[BPry]

@UNIRIO,

Also just to add onto what @${userLoginName} mentioned already, I'd double check that you have a file blocking profile associated with all external traffic with at least an alert option so you can potentially look into the files that are being transferred going forward. If you're decrypting traffic you'll obviously get drastically more information, but in conjunction with your EDR (assuming that you have one) it can help speed up the process to identify whether the traffic is legitimate or not.