Change the Brute Force Trigger Criteria

• PA Firewalls
• All Panos releases with vulnerability Protection profile. 

• One wants to edit the default value according to the company policy. 

Overview

This document describes how to view and edit the default number of attempts it takes to successfully trigger a brute-force attempt passing through the Palo Alto Networks firewall.

Steps

1. Open the Vulnerability profile, go to GUI: Object > Security Profiles > Vulnerability Protection, and select the desired Vulnerability Protection profile
   
   
   
2. Click on the Exceptions tab
   
   
   
3. Check the Show All Signatures box and search for "brute force" or the Threat ID in the search field
   
   
   
4. Click on the pencil icon next to the signature name to edit the Time Attributes as desired. The Aggregation Criteria can be Source, Destination, or Source-and-Destination.
   
   
   
   
   
5. After making the customization, click the Enable check box to enable the signature and click ok
   
   
   
6. Commit the changes

IMPORTANT NOTE:  The "Action" configured under "Exceptions" will take precedence over the action configured under "Rules" in the Vulnerability Protection profile. In the above screenshot, we can see that the action is "alert," and that's the action that'll be taken when this signature is triggered.

The list of brute force vulnerabilities is found in the following reference document: Brute Force Signature and Related Trigger Conditions