Threat Review during Implementation
November 09, 2017
Threat Review during Implementation
Score 9 out of 10
Vetted Review
Verified User
Overall Satisfaction with Palo Alto Networks Threat Protection
Threat Protection is being used on a multitude of levels- first all Internet traffic has active threat policies for protection from malicious sites and malware. Other locations utilize threat as a sanity check and second source for other IDS/IPS systems. We are continually tuning and working with Palo Alto to better their threat protection capabilities.
- The threat engine has constant updates for important threats.
- Wildfire helps supplement the Threat engine to help protect against 0 day threats.
- The way the threat engine can be added at different levels to different zones and policies helps to ensure business essential traffic can have policies that are tuned to ensure traffic will flow.
- Visibility into signatures and how they function/what triggers them would be very beneficial.
- Lacking customizability compared to other tools.
- Inability to write custom signatures easily and for traffic with small (less than 8 bit) signatures.
- New deployment hasn't been fully calculated yet.
- With the addition of Panorama and central logging, event investigation has become more streamlined.
It is comparable but not as robust as other stand alone IPS/IDS.