Top 5 attackers

Our company are using Palo Alto Firewall ,we received the critical alert "Top 5 attackers" and the source is from one of the application server. What does it mean and what should I do .Please advice.Thanks
YaYangTeahAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JohnBusiness Consultant (Owner)Commented:
I have seen Symantec Endpoint tell me that my printer is attacking my system. I turned off messages about the printer. I suggest you except your application server in the firewall
0
Qlemo"Batchelor", Developer and EE Topic AdvisorCommented:
Such reports are either false positives (the behaviour reported is expected) or an indication for temporary issues. Being caused by real attack is unlikely but possible.
I would care only if you see it more often, and then consider what to do next: Exclude the IP from getting scanned, exclude the specific behaviour from getting scanned, check if you can suppress the specific behaviour causing the reported alert (this is the best choice).
0
Blue Street TechLast KnightCommented:
Hi YaYangTeah,

First verify your app server is not infected. You need to rule this out as either a red-herring/false-positive or an actual threat. Are you running endpoint AV on your application server? Regardless either make sure your AV definitions are current and perform a deep scan (typically after-hours) and if you don't have an endpoint AV application then go to https://www.eset.com/us/home/online-scanner/ and run the online scanner. You can also download Malwarebytes (https://www.malwarebytes.com/) and RootKit Remover (https://labs.bitdefender.com/2013/02/rootkit-remover/) or GMER (http://www.gmer.net/) - run each independently (not at the same time). Make sure events are not coinciding with your firewall's alert that are in fact malicious. Drill down into the report and see what users, ports and types of traffic are triggering the incident.

Let me know how it goes!
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
YaYangTeahAuthor Commented:
I found  from the firewall log ,that IP has frequently try to authenticate with one of the server in the cloud then I asking our application and reply said they are testing sending notification but failed and the system automatically keep re-trying.

After I feedback to them aftrr couple of days they are fix thier issue.now that IP  no more is high attacker.
1
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Hardware Firewalls

From novice to tech pro — start learning today.