Create a Support Case in the CSP

Table of Contents

Create a Support Case in the CSP

Open a support case with Palo Alto Networks through the Customer Support Portal (CSP) to report DNS threat detection issues with your Advanced DNS Security deployment on Route 53.

Where Can I Use This?	What Do I Need?
Palo Alto Networks Customer Support Portal	Advanced DNS Security subscription (active) CSP account (registered)

If you encounter DNS threat detection issues with your Advanced DNS Security deployment on Amazon Route 53—such as false positives, false negatives, or unexpected category behavior—open a support case with Palo Alto Networks through the Customer Support Portal (CSP). Palo Alto Networks support engineers investigate issues related to DNS security category accuracy and threat detection coverage.

When creating a support case, include as much detail as possible to help Palo Alto Networks engineers reproduce and investigate the issue efficiently.

Sign in to the Palo Alto Networks Customer Support Portal at support.paloaltonetworks.com.
From the CSP home page, select Create a Case.
Select the type of assistance you need.
- Create a Technical Case—Select this option to resolve technical product issues, such as false positives, false negatives, or unexpected DNS security category behavior.
- Create an Administrative Case—Select this option to resolve non-product, administrative issues related to accounts, inventory, cases, member management, and licensing.
Select your product.

Under Cloud Delivered Security Services, select Advanced DNS AWS R53.
Select your Serial Number/Entitlement Group ID from the list.

The list displays your registered products with columns for Product, Serial Number/Entitlement Group ID, Asset Tag, Category, Device Name, Support Type, and Expiration. Select the entry associated with your Advanced DNS Security for Route 53 subscription.
Provide a descriptive case title that summarizes the issue.

For example: "False positive—legitimate domain blocked by Command and Control category" or "Known malicious domain not detected by Malware Domains category."
In the case description, include the following details:
- Affected domain(s)—The fully qualified domain name (FQDN) that was incorrectly blocked or not detected.
- DNS security category—The category that triggered the action (for false positives) or the category you expected to match (for false negatives).
- Observed behavior—What happened (e.g., domain was blocked, alert was generated, no action was taken).
- Expected behavior—What you expected to happen based on the category definition.
- AWS region—The AWS region where the affected VPC is deployed.
- Timestamp—The approximate date and time when the issue was observed.
- AWS account ID—The account ID associated with your Advanced DNS Security subscription.
Set the case severity based on the business impact of the issue.
Select Continue to submit the case.

You receive a case number and can track the status of your case through the CSP. Palo Alto Networks support engineers may follow up with additional questions or request DNS query logs from CloudWatch to assist with the investigation.