The default action is defined by Palo Alto Networks on a per-threat basis as either alert or block. Every vulnerability has a "block" behavior. Some block behaviors send a reset to the server or client, or in this case, both. For this example the default action is block, and the block behavior is reset-both. Even though the action being taken is block, the threat log will show the block behavior that was used to terminate the session under the action column. Quick edit: If you want to change the "block" behavior for a threat, you must configure an exception.
... View more