---
title: Supply Chain Firewall Package Reported
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Supply Chain Firewall Package Reported
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Supply Chain Firewall Package Reported
Classification:attackTactic:[TA0001-initial-access](https://attack.mitre.org/tactics/TA0001)Technique:[T1195-supply-chain-compromise](https://attack.mitre.org/techniques/T1195) 
## Goal{% #goal %}

{{#is_match "case_name" "Package allowed"}} The {{@scfw_report.ecosystem}} package {{@scfw_report.package}}@{{@scfw_report.version}} has been installed by Supply Chain Firewall. {{/is_match}} {{#is_match "case_name" "Package blocked"}} The {{@scfw_report.ecosystem}} package {{@scfw_report.package}}@{{@scfw_report.version}} has been blocked by Supply Chain Firewall. {{/is_match}} {{#is_match "case_name" "Malicious package allowed"}} The {{@ecosystem}} package {{@package_name}} is malicious and was previously installed on {{malicious_package_hosts}} host(s). {{/is_match}}

## Triage and Response{% #triage-and-response %}

{{#is_match "case_name" "Package allowed"}} Any logs detected by this rule are for package manager commands that were allowed to run.

- Examine the logs to determine which package has been scanned by Supply Chain Firewall.

- Investigate the context in which the command was executed. {{/is_match}} {{#is_match "case_name" "Package blocked"}} Any logs detected by this rule are for package manager commands that were blocked from running.

- Examine the logs to determine which package has been scanned by Supply Chain Firewall.

- Investigate the context in which the command was executed.

### Blocked Package{% #blocked-package %}

The package was **blocked** from being installed. Determine whether this was a true positive or a false positive:

- **False positive**: This can occur when a benign package hosted internally in your enterprise has the same name as a malicious package hosted on the public registry.
- **True positive**: Audit other endpoints in your environment for completed installations of the packages of concern. {{/is_match}} {{#is_match "case_name" "Malicious package allowed"}}

### Malicious Package{% #malicious-package %}

Supply Chain Firewall allowed this package before it was flagged as malicious (for example, by Guarddog or a policy update). It was already installed on multiple hosts before the risk was known.

- Treat this as a **true positive** by default: The package is confirmed malicious, and the open question is exposure, not legitimacy.
- Review the signal's related logs to identify the affected hosts, and determine whether the package is still present or has run.
- Remove or quarantine the package on each affected host, and rotate any credentials or secrets that may have been exposed.
- Check for any suspicious activity after the package's installation on the affected hosts. {{/is_match}}