Abnormal SSL traffic on 443

[LaportePitts]

Hello I was looking into an pan threat on the logs I noticed that I Abnormal traffic is being detected  does anyone have any ideas to minimize the threat or Best Practices or more possible features I can add to the Panorama

Thanks  

[ymiyashita]

From your description, I understand that you are seeing "Abnormal SSL traffic on port 443 (54699)" detected on the firewall and on the panorama you are seeing the threat log forwarded by the firewall.
https://threatvault.paloaltonetworks.com/?query=Abnormal SSL traffic on 443&type=

I would advise you to take a threat pcap and verify if the traffic is actually abnormal. Most likely, the SSL handshake is missing.
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/take-packet-captures/take-a-th...

If it's a true positive, you can change the default action to block the traffic to minimize the threat since it's an abnormal traffic.
STEPS TO CHANGE THE DEFAULT ACTION FOR SIGNATURES
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm3KCAS