>
    Strata Copilot
    Report Advanced IP Defense False Positives
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced IP Defense
    3. Monitor Advanced IP Defense
    4. Report Advanced IP Defense False Positives
    Download PDF
    Advanced IP Defense

    Report Advanced IP Defense False Positives

    Table of Contents

    Report Advanced IP Defense False Positives

    Report false positive detections to Palo Alto Networks to improve Advanced IP Defense attribution accuracy and reduce operational disruption.
    Where Can I Use This?What Do I Need?
    • PAN-OS 12.2 and later
    • Strata Cloud Manager
    • PAN-OS 11.1.x and later (EDL-based)
    • Advanced IP Defense license
    • Admin access to firewall or Strata Cloud Manager
    Advanced IP Defense maintains a false positive rate of 1% or less for IP attribution. However, in some cases, a legitimate IP address may be incorrectly assigned an attribute that causes your policy rules to block or alert on traffic that should be allowed. When this occurs, you can mitigate the immediate impact by creating an exception or allowlist entry, and then report the false positive to Palo Alto Networks so the research team can investigate and correct the attribution.
    False positives in IP attribution can occur for several reasons. Shared hosting environments may cause an IP to inherit attributes from a malicious tenant that previously used the same address. Cloud provider IP ranges are frequently reassigned between customers, and attribution updates may lag behind the reassignment. Legitimate services that exhibit behavior similar to malicious activity, such as high-volume scanning for security research, may be misclassified. Reporting false positives helps the Advanced IP Defense research team refine their detection methods and update the IP attribute database for all customers.
    1. Identify the false positive in your Advanced IP Defense logs.
      Review the threat logs to find the log entry for the traffic you believe was incorrectly matched. Note the following details from the log entry:
      • Destination IP address that was incorrectly attributed
      • IP attribute category and subcategory that triggered the match
      • Policy rule name and action taken
      • Timestamp of the event
      • The legitimate service or application that the IP hosts
    2. Create an exception to mitigate the immediate impact.
      While you investigate and report the false positive, create an exception in your Advanced IP Defense profile for the affected IP address. This prevents the IP from being blocked or alerted on while the false positive report is under review. You can create an IP-based exception, an IP-port pair exception for more granular control, or an EDL-based exception if multiple related IPs are affected.
    3. Gather supporting evidence for the false positive report.
      Collect information that demonstrates the IP is legitimate. This can include:
      • The domain name and service hosted on the IP
      • DNS records showing the IP is associated with a legitimate domain
      • WHOIS information for the IP showing the registered owner
      • Traffic patterns showing the IP is used for legitimate business purposes
      • Any relevant threat intelligence reports from third-party sources that confirm the IP is benign
    4. Report the false positive to Palo Alto Networks.
      Open a support case with Palo Alto Networks and include the following information:
      • The IP address and the attribute that you believe is a false positive
      • The supporting evidence you gathered
      • The Advanced IP Defense threat log entries showing the incorrect match
      • Your firewall model, PAN-OS version, and Advanced IP Defense profile configuration
      The Advanced IP Defense research team tracks all false positive reports through a change request process and investigates each report to determine whether the attribution should be corrected.
    5. Monitor for the attribution correction.
      After reporting the false positive, monitor your Advanced IP Defense logs for the affected IP. Once the research team corrects the attribution, the IP's attributes are updated in the Advanced IP Defense cloud service and the correction propagates to your firewall on the next cache refresh. The cache TTL for most threat-related attributes is 300 seconds (5 minutes), so corrections typically take effect within minutes of being published. After you confirm the correction, remove the temporary exception you created.

    © 2026 Palo Alto Networks, Inc. All rights reserved.