Port Scan Activity (External) too much noise but can there be a way to really Alert only on risky ports (config is vulnerable)

[MManangan]

I got an AHA/Idea (aka RFE) for Prisma Cloud's Network Anomaly of Port Scan Activity (external) as Prisma Cloud just alerts as-is if someone is knocking at our door regardless if the port is secure otherwise.

We want some intelligence built-in to check first if that port scanned is a real threat with a risky configuration but if it is hardened and secured then it should NOT alert at all to not add to the noise.

Here's my IDEA- please vote for it for the vendor to work into adding more checks and intelligence to the Policy:  

• PANW-I-2699

[JJoly]

Hello @MManangan,

We investigated a bit on those alerts and in our context, it seems false positive most of the time.

I will vote on you request 🙂

JB