Why there are 2 threats of same name but different severity

[raji_toor]

I see these alerts with same name and description, where as one is considered low and other as medium.

Why do they even have different ID's

[Curt_Wilson · Accepted solution]

They each have their own vulnerability signature, therefore a unique Threat ID.  I see a total of 26 threats that are named "HTTP SQL Injection Attempt", 1-high, 23-medium, and 2-low in severity.

[raji_toor]

So should blocking be done based on severity only?

[Curt_Wilson]

I don't want to say based on severity "only", but for us it definitely helps simplify things so that everytime Palo Alto releases a new Threat ID we don't have to go configure a custom action for each one.  We also don't feel comfortable using a default action of "alert" for a critical severity threat.

This is what we do...  For critical, high, and medium threats we use "reset-both" action.  For low threats we use "default" action (which uses the individual threat's action recommended by Palo Alto).  For informational threats we use "allow" action.  Then we use "exceptions" when we have a Threat ID we want configured differently than based on severity.