Palo Threat Prevention

Range/Series Overview

IMPORTANT: This Range/Series overview section describes the range of which this product belongs. Features of different versions might be mentioned and may not apply to the specific product on this page. Please view Specs for specification of product.

Adversaries have become highly targeted, leveraging sophisticated playbooks to breach an organization, move laterally, and extract valuable data, all while remaining invisible to traditional defenses. Threat Prevention automatically stops vulnerability exploits with IPS capabilities, offers in-line malware protection, and blocks outbound command-and-control traffic. When combined with WildFire and URL Filtering, organizations are protected at every stage of the attack lifecycle, including both known and zero-day threats.

Features Summary

• Intrusion prevention
  Vulnerability-based protections detect and block exploits and evasive techniques on both the network and application layers, including port scans, buffer overflows, packet fragmentation, and obfuscation. The IPS protections combine both anomaly detection and signature matching, using stateful pattern matching to understand packet arrival order and sequence.
• Malware protection
  Threat Prevention enforces in-line malware protection, preventing malware delivery and installation through the proprietary payload-based signature, which also leverages the WildFire service for zero-day malware discovery. Payload-based signatures do not rely on easily changed attributes, instead detecting patterns in the body of the file, that can be used to identify future variations of the malware, even if the content has been slightly modified. This allows to immediately identify and block polymorphic malware, that otherwise would be treated as unknown file.
• Command-and-control prevention
  Threat Prevention stops command-and-control (C2) activity from being used to exfilrate data, deliver secondary malware payloads, or provide additional instructions for future stages of the attack. The service employs a revolutionary approach to shutting down this critical channel, generating automated C2 signatures, that go beyond basic domain and URL matching to produce research-grade protections at machine speed and scale. Threat Prevention also provides sinkhole capabilities for requests to malicious DNS entries, allowing outbound requests to malicious domains or IP addresses to be redirected to your own internal IP address, preventing command-and-control activity and providing you with a report of compromised machines.

Specification Summary