Top 5 attackers

Our company are using Palo Alto Firewall ,we received the critical alert "Top 5 attackers" and the source is from one of the application server. What does it mean and what should I do .Please advice.Thanks
YaYangTeahAsked:
Who is Participating?
 
Blue Street TechLast KnightCommented:
Hi YaYangTeah,

First verify your app server is not infected. You need to rule this out as either a red-herring/false-positive or an actual threat. Are you running endpoint AV on your application server? Regardless either make sure your AV definitions are current and perform a deep scan (typically after-hours) and if you don't have an endpoint AV application then go to https://www.eset.com/us/home/online-scanner/ and run the online scanner. You can also download Malwarebytes (https://www.malwarebytes.com/) and RootKit Remover (https://labs.bitdefender.com/2013/02/rootkit-remover/) or GMER (http://www.gmer.net/) - run each independently (not at the same time). Make sure events are not coinciding with your firewall's alert that are in fact malicious. Drill down into the report and see what users, ports and types of traffic are triggering the incident.

Let me know how it goes!
0
 
JohnBusiness Consultant (Owner)Commented:
I have seen Symantec Endpoint tell me that my printer is attacking my system. I turned off messages about the printer. I suggest you except your application server in the firewall
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
Such reports are either false positives (the behaviour reported is expected) or an indication for temporary issues. Being caused by real attack is unlikely but possible.
I would care only if you see it more often, and then consider what to do next: Exclude the IP from getting scanned, exclude the specific behaviour from getting scanned, check if you can suppress the specific behaviour causing the reported alert (this is the best choice).
0
 
YaYangTeahAuthor Commented:
I found  from the firewall log ,that IP has frequently try to authenticate with one of the server in the cloud then I asking our application and reply said they are testing sending notification but failed and the system automatically keep re-trying.

After I feedback to them aftrr couple of days they are fix thier issue.now that IP  no more is high attacker.
1
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.