I’m having an issue identifying the offending file that triggered a vulnerability detection. We had an IT admin transfer a large batch of files across a network segment that traveled on of or PA firewllls. One of the transfers triggered an alert for an Adobe Reader remote code execution signature. The “file name” in Panorama shows “content.xml” but does not show the actual name of the file that contained code that matched the signature.
How does one find the actual offending file in instances like this?
We’ve encounteed similar issues with the virus profile too. During the transfer of files the palo will alert on a virus detection but will not show the actual name of the malicious file. This makes response very challenging.
