threat_id - ID ancaman Palo Alto Networks yang unik.
name - Nama ancaman.
alert_severity - Tingkat keparahan ancaman. Salah satu dari INFORMATIONAL, LOW,
MEDIUM, HIGH, atau CRITICAL.
type - Jenis ancaman.
category - Subjenis ancaman.
alert_time - Waktu saat ancaman ditemukan.
network - Jaringan pelanggan tempat ancaman ditemukan.
source_ip_address - Alamat IP sumber traffic yang dicurigai. Saat Anda menggunakan
load balancerGoogle Cloud , alamat IP klien yang sebenarnya tidak
tersedia, dan alamat ini adalah alamat IP load balancer Anda.
destination_ip_address - Alamat IP tujuan traffic yang dicurigai.
source_port - Port sumber traffic yang dicurigai.
destination_port - Porta tujuan traffic yang dicurigai.
ip_protocol - Protokol IP traffic yang dicurigai.
application - Jenis aplikasi traffic yang dicurigai—misalnya, SSH.
direction - Arah traffic yang dicurigai (klien-ke-server atau server-ke-klien).
session_id - ID numerik internal yang diterapkan ke setiap sesi.
repeat_count - Jumlah sesi dengan IP sumber, IP tujuan, aplikasi, dan jenis yang sama yang terlihat dalam waktu 5 detik.
uri_or_filename - URI atau nama file ancaman yang relevan, jika ada.
cves - daftar CVE yang terkait dengan ancaman
details - Informasi tambahan tentang jenis ancaman, yang diambil dari ThreatVault Palo Alto Networks.
Menelusuri Threat Vault Palo Alto Networks
Gunakan petunjuk berikut untuk menelusuri Common Vulnerabilities and Exposures (CVE), ID ancaman, nama ancaman, dan kategori ancaman.
Jika Anda belum memilikinya, buat akun di LiveCommunity Palo Alto Networks.
Akses Threat Vault Palo Alto Networks menggunakan akun Anda.
Di Threat Vault, telusuri salah satu nilai berikut berdasarkan informasi dari notifikasi ancaman Anda:
Satu atau beberapa CVE dari kolom cves
THREAT_ID dari kolom threat_id
THREAT_NAME dari kolom name
CATEGORY dari kolom category
Pastikan status tanda tangan bertuliskan Dirilis, bukan Dinonaktifkan.
Jika Dinonaktifkan, tanda tangan tidak lagi valid dan dinonaktifkan.
Saat Cloud IDS menerima update dari Palo Alto Networks, tanda tangan tersebut berhenti menghasilkan pemberitahuan.
Jika file memicu temuan, lakukan langkah-langkah berikut:
Telusuri hash yang terkait dengan tanda tangan di situs VirusTotal untuk menentukan apakah ada yang berbahaya.
Jika hash file yang memicu tanda tangan diketahui, bandingkan dengan hash di Threat Vault. Jika tidak cocok, berarti terjadi
bentrokan tanda tangan,
yang berarti bahwa file dan sampel berbahaya mungkin berisi nilai byte yang sama pada offset byte yang sama.
Jika cocok dan file tidak berbahaya, itu adalah positif palsu dan Anda dapat mengabaikan notifikasi ancaman.
Jika ancaman DNS atau command-and-control memicu temuan, lakukan langkah-langkah berikut:
Mengidentifikasi domain tujuan yang memicu tanda tangan pada komunikasi keluar dari endpoint.
Selidiki reputasi domain dan alamat IP yang terlibat untuk mengembangkan pemahaman yang luas tentang potensi tingkat ancaman.
Jika traffic berdampak pada bisnis dan Anda yakin bahwa traffic tersebut tidak berbahaya, atau jika Anda bersedia menerima risiko, Anda dapat menambahkan Pengecualian Ancaman ke endpoint Cloud IDS untuk menonaktifkan ID ancaman.
Terapkan aturan Cloud Armor atau
aturan Cloud NGFW untuk
memblokir traffic berbahaya menggunakan alamat IP sumber dan tujuan koneksi
dalam temuan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-01 UTC."],[[["\u003cp\u003eThis page outlines the process for investigating threat alerts generated by Cloud IDS, focusing on reviewing the details and taking action.\u003c/p\u003e\n"],["\u003cp\u003eAlert details include fields like \u003ccode\u003ethreat_id\u003c/code\u003e, \u003ccode\u003ename\u003c/code\u003e, \u003ccode\u003ealert_severity\u003c/code\u003e, \u003ccode\u003esource_ip_address\u003c/code\u003e, \u003ccode\u003edestination_ip_address\u003c/code\u003e, and many other identifiers in the JSON alert logs, providing comprehensive information on each threat.\u003c/p\u003e\n"],["\u003cp\u003eThe Palo Alto Networks Threat Vault can be searched using CVEs, threat IDs, threat names, or categories found in the alert logs to gain deeper insights into specific threats.\u003c/p\u003e\n"],["\u003cp\u003eFor file-based threats, the associated file hashes can be checked on VirusTotal and compared in the Threat Vault to determine if they are malicious or if it may be a signature collision or false positive.\u003c/p\u003e\n"],["\u003cp\u003eFor actionable results on traffic that is not considered malicious, there is the option to add Threat Exceptions in Cloud IDS or to block the traffic using Google Cloud Armor or Cloud NGFW rules.\u003c/p\u003e\n"]]],[],null,["# Investigate Threat Alerts\n\nThis page provides details about how to investigate the threat alerts that Cloud IDS\ngenerates.\n\nReview alert details\n--------------------\n\nYou can review the following JSON fields in the [alert log](/intrusion-detection-system/docs/logging):\n\n- `threat_id` - Unique Palo Alto Networks threat identifier.\n- `name` - Threat name.\n- `alert_severity` - Severity of the threat. One of `INFORMATIONAL`, `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL`.\n- `type` - Type of the threat.\n- `category` - Sub-type of the threat.\n- `alert_time` - Time when the threat was discovered.\n- `network` - Customer network in which the threat was discovered.\n- `source_ip_address` - Suspected traffic's source IP address. When you use a Google Cloud load balancer, the true client IP address is not available, and this address is the IP address of your load balancer.\n- `destination_ip_address` - Suspected traffic's destination IP address.\n- `source_port` - Suspected traffic's source port.\n- `destination_port` - Suspected traffic's destination port.\n- `ip_protocol` - Suspected traffic's IP protocol.\n- `application` - Suspected traffic's application type---for example, SSH.\n- `direction` - Suspected traffic's direction (client-to-server or server-to-client).\n- `session_id` - An internal numerical identifier applied to each session.\n- `repeat_count` - Number of sessions with the same source IP, destination IP, application, and type seen within 5 seconds.\n- `uri_or_filename` - URI or filename of the relevant threat, if applicable.\n- `cves` - a list of CVEs associated with the threat\n- `details` - Additional information about the type of threat, taken from Palo Alto Networks' ThreatVault.\n\nSearch the Palo Alto Networks Threat Vault\n------------------------------------------\n\nUse the following instructions to search for Common Vulnerabilities and Exposures (CVEs),\nthreat IDs, threat names, and threat categories.\n\n1. If you don't already have an account, create an account on Palo Alto Networks'\n [LiveCommunity](https://live.paloaltonetworks.com/).\n\n2. Access the Palo Alto Networks\n [Threat Vault](https://www.paloaltonetworks.com/blog/threat-vault/)\n using your account.\n\n3. In the Threat Vault, search for any of the following values based on information from\n your threat alert:\n\n - One or more \u003cvar translate=\"no\"\u003eCVE\u003c/var\u003e from the `cves` field\n - \u003cvar translate=\"no\"\u003eTHREAT_ID\u003c/var\u003e from the `threat_id` field\n - \u003cvar translate=\"no\"\u003eTHREAT_NAME\u003c/var\u003e from the `name` field\n - \u003cvar translate=\"no\"\u003eCATEGORY\u003c/var\u003e from the `category` field\n4. Verify that the signature status says **Released** and not **Disabled**.\n\n 1. If **Disabled**, the signature is no longer valid and is disabled. When Cloud IDS catches up on updates from Palo Alto Networks, the signature stops generating alerts.\n5. If a file triggered the finding, perform the following steps:\n\n 1. Search for the hashes that are associated with the signature on the VirusTotal website to determine whether any of them are malicious.\n 2. If the hash of the file triggering the signature is known, compare it to those in Threat Vault. If they don't match it's a [signature collision](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm3SCAS), which means that the file and the malicious sample might contain the same byte values in the same byte offsets. If they do match and the file isn't malicious, it's a false positive and you can disregard the threat alert..\n6. If a command-and-control or DNS threat triggered the finding, perform the following steps:\n\n 1. Identify the destination domain that triggered the signature on outbound communications from an endpoint.\n 2. Investigate the reputation of domains and IP addresses involved to develop a broad understanding of the potential threat level.\n7. If the traffic has a business impact and you are convinced that the traffic isn't\n malicious, or if you are willing to accept the risk, you can add\n [Threat Exceptions](/intrusion-detection-system/docs/configuring-ids#optional_configure_threat_exceptions)\n to your Cloud IDS endpoint to disable the threat ID, .\n\n8. Implement a [Cloud Armor rule](/armor/docs/rules-language-reference) or a\n [Cloud NGFW rule](/firewall/docs/firewall-policies-rule-details) to\n block the malicious traffic using the connection source and destination IP addresses\n in the finding."]]
