Question regarding "reset-both" action

[miyaaccount]

I've been seeing alot of Code Executions on Palo Alto Threat logs, most of them are not applicable on our servers and had an action of "Reset-both". Did the Firewall completely blocked the connection or there's a connection happened but did not complete since both server and client had a RST.

Also same on application based, there's a lot of "Reset-both" teamviewer connections on my logs, is it advisable to completely blocked it so it won't appear on my firewall logs?

[reaper]

The 'reset-*' action will inject a RST packet into the tcp stream, breaking the connection.

So a connection exists, a threat is detected and blocked, and a RST is sent to end the session

[MP18]

So  in this case PA sends the reset connection to both pc and server at same time right?

[reaper]

for reset-both yes

RST is sent to client and server at the same time

[MP18]

Many Thanks Reaper need to learn lot from you.

[reaper]

That can be arranged 😉

[MGPIBM]

Question trying to resolve a logging issue we are using thresholds to block-ip source our  Qradar instance is not seeing the block-ip logs  all logging function are functioning properly from our Pano.  I was going to turn on log at session start and also considering changing it to see if reset-both would show up.  Any thoughts or explanations would be helpful thanks.