Threat blocked by Palo Alto: Is there anything else to do?

[yschinck]

Hi,

When the Palo Alto blocks a communication that is flags as a threat (ie: SQL Injection, XSS, etc.), should we investigate the target IP to make sure that the threat was blocked? The reason I'm asking is that whenever the Palo Alto blocks an attack from an IP address (Session End Reason is "threat"), if we go in the "Traffic" view, we can see that not all the communications with that offending IP were terminated with a "threat" reason. Some of them are terminated by "tcp-rst-from-client" or "tcp-rst-both". In that case, I'm wondering if part of the attack (or payload) could have gone through to the destination IP before the Palo Alto stopped it. Are these connections expected and there should be nothing to worry about, or should we still investigate?

Thank you.

[yschinck]

Bump.

Should I just create a ticket and ask that question to the support directly...?

[OtakarKlier]

Hello,

I would investigate, but it doesnt mean that thigns were compromised. It could have just been a scan and some of the traffic was allowed and some got blocked. While not always a good indicator, you have to look at all the traffic holistically, I look at the amount of data transferred, was it a large amount or small.

Hope that helps.