07-12-2020 08:18 AM
Getting false positive for the Link tivoli.com.qa as threat name(68360795).Its getting DNS sinkholing.Can anyone help to know how we give the exception only for the threat ID 68360795 and the Fqdn is tivoli.com.qa. Attached screenshots below
07-13-2020 11:14 AM
Hi @hisingh ,
Thanks for your reply.Please find the detailed threat log for ID 68360795
as mentioned before most 68360795 is unknow in my firewall also most of the signatures are unknown. I checked in another firewall which is having same content version and i can see the 68360795 is
visible.But same in my firewall showing as unknown.If you can check the previous screenshots related to exception you can see the ID eg: 327772845 which is also showing as unknown.For confirming please check this ID in your FW
07-14-2020 12:39 PM
Did you check the threat vault connectivity from PA devices.
Test connectivity to the Threat Vault using:
> test threat-vault connection
or you can check it from System logs.
07-14-2020 12:56 PM
Thanks for your commments. Now its working after changing the DNS to public.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!