Palo Alto Networks Knowledgebase: How to Create a Custom Report for Heartbleed (CVE-2014-0160) Attacks

How to Create a Custom Report for Heartbleed (CVE-2014-0160) Attacks

1378
Created On 02/07/19 23:39 PM - Last Updated 02/07/19 23:40 PM
Resolution

Steps

  1. Go to Monitor > Custom Reports and click New
  2. Enter a Name for the report and configure the following values:
    • Database: Threat Summary
    • Time Frame: Last 24 Hrs
      pastedImage_0 copy.png

  3. Select the columns to be displayed in the report, as needed.
  4. Under Query Builder, configure the following query:
    "(threatid eq 36416) or (threatid eq 36418) or (threatid eq 40039)"

pastedImage_0.png

pastedImage_1.png

pastedImage_0-1.png

Note: In this last snapshot, the Time Frame has been changed to Last Calendar Day because Scheduled was enabled.

 

The following is a description of the three threat ID numbers:

  • 36416: OpenSSL TLS Heartbeat Information Disclosure Vulnerability - Heartbleed
    This signature analyzes the request and response lengths to look for abnormalities.  This does require the server to be vulnerable, due to the data that this signature analyzes and compares.  It is effective against a single "probe", meaning it does not need bulk requests to trigger.
  • 40039: OpenSSL TLS Heartbeat Brute Force - Heartbleed
    This signature triggers on a high rate of heartbeat requests.  This does NOT require that the server be vulnerable, because it is only looking at client-side, however it does require multiple heartbeat requests indicative of a more "real world" attack, so a single "test probe" will not trigger the signature.
  • 36418: OpenSSL TLS Malformed Heartbeat Response Found - Heartbleed
    This signature triggers on a malformed server response.  This does require the server to be vulnerable, due to the data that this signature analyzes and compares.  It is effective against a single "probe", meaning it does not need bulk requests to trigger.

 

owner: jjosephs



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClwhCAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language