TCP SYN with data Threat logs

[leandro.ramos]

Hi Guys,

I receive hundreds of TCP SYN with data Threat Alerts from my BYOD zone every day. I was learning more about it and I understood that it is a TCP syn packet with data in its payload. However, as almost all of them seems to come from non-malicious sources, I am not sure if I should worry about it or just consider it as a false positive and tweak my firewall.

Any advice would be much appreciated.

Thanks

Leandro Ramos

[mivaldi]

If the firewall detects a TCP packet with data and your Zone Protection profile is set to drop these, then I wouldn't think it is a false positive. It triggers the protection because the firewall sees these.

More information available at:

https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/networking-features/zone-p...

There is currently no way to inhibit these protections from writing to the Threat Logs, however, if you receive the alerts through a Log Forwarding profile, you can edit the profile so that these are not forwarded out using a Filter in PAN-OS 8.0:

(severity eq informational) and (threatid neq 8723)

Selective Log Forwarding

https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/management-features/select...

Video Tutorial

https://live.paloaltonetworks.com/t5/Tutorials/Tutorial-Filtered-Log-Forwarding/ta-p/145950

[leandro.ramos]

Hi Mivaldi,

Thank you very much for all the information provided.

Regards,

Leandro Ramos