Traffic log action shows allow but session end shows threat

[PPradhan]

Hi 

I need to know if any traffic log is showing allow and if the session end reason is showing as threat than in that case the traffic is allowed, or it's blocked, and also I need to know why the traffic is showing us threat.

[PavelK]

Hello @PPradhan

this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCQlCAO gives best answer. In nutshell, the log is showing as allowed as it is not blocked by security policy itself (6 tuple), however traffic if processed further by L7 inspection where it is getting block based on threat signature, therefore this session is in the end blocked with end reason threat.

Kind Regards

Pavel