topic Re: Multiple events "A Successful login from TOR" in Cortex XDR Discussions

Multiple events "A Successful login from TOR"

AndreSilva — Mon, 27 Mar 2023 21:19:36 GMT

Hi,

We are seeing a lot of events from CORTEX "A Successful login from TOR". Anyone else with this problem?

Seems to be a bug.

Re: Multiple events "A Successful login from TOR"

seth-ultradent — Mon, 27 Mar 2023 21:21:00 GMT

Yes, registered here just to confirm I'm not the only one

Re: Multiple events "A Successful login from TOR"

keevang — Mon, 27 Mar 2023 21:25:04 GMT

We're seeing the same thing as well. Still trying to get confirmation from Palo Alto.

Re: Multiple events "A Successful login from TOR"

AndreSilva — Mon, 27 Mar 2023 21:29:24 GMT

We have a Palo Alto partner that told it is a false-positive and the events started when this BIOC was update, but it will be good a confirmation from Palo Alto

Re: Multiple events "A Successful login from TOR"

JoelDBooth — Mon, 27 Mar 2023 21:30:18 GMT

Seeing the same thing. Started about hour and a half ago. Makes no sense to us. Opened a case with support but haven't been contacted yet. Looks like a BIOC rule issue to me.

Re: Multiple events "A Successful login from TOR"

Rapha — Mon, 27 Mar 2023 21:31:14 GMT

We were seeing the exact same things but the alerts stopped about 20 min ago.

Re: Multiple events "A Successful login from TOR"

JoelDBooth — Mon, 27 Mar 2023 21:38:31 GMT

Looks like it is this BIOC update that has caused the problem. Info on the update here.

https://live.paloaltonetworks.com/t5/cortex-xdr-articles/content-release-notes/ta-p/257570

Re: Multiple events "A Successful login from TOR"

MartinCimone — Mon, 27 Mar 2023 21:41:30 GMT

Same here. No Official answer yet from PaloAlto Support

Re: Multiple events "A Successful login from TOR"

RonaldWeiss — Mon, 27 Mar 2023 21:43:40 GMT

Same here...

Re: Multiple events "A Successful login from TOR"

anlynch — Mon, 27 Mar 2023 21:43:55 GMT

Hi everyone!

Thanks for reaching out to LIVEcommunity!

It appears that you guys are aware of an ongoing issue at the moment. It appears a bad BIOC rule went out with a recent Content Update. Our support teams are aware and they are currently working on the issue.

Right now there's nothing you need to do. You don't need to start a support case.

As the situation changes I'll try to make sure that this thread is updated with any new information.

Re: Multiple events "A Successful login from TOR"

AndersonStiven_Vasquez — Mon, 27 Mar 2023 21:55:53 GMT

Hi Anlynch

Thank you for your answer.

Could you share the Paloalto's official communication in this threat when it's resolved?

Thank you in advance,

Best regards.

Re: Multiple events "A Successful login from TOR"

cyberjake22 — Mon, 27 Mar 2023 22:36:18 GMT

We had the same issue. 15 alerts from 3:06PM to 4:03PM CST.

Re: Multiple events "A Successful login from TOR"

AUNet_Wolf — Mon, 27 Mar 2023 22:54:07 GMT

Love getting woken by the NOC for false positives

116 Alerts from 06:09 to 07:23 AEST (UTC+10)

Re: Multiple events "A Successful login from TOR"

ZeeD — Mon, 27 Mar 2023 23:07:11 GMT

Confirmed bug by Palo Alto - Cortex support !

Re: Multiple events "A Successful login from TOR"

Pramita — Tue, 28 Mar 2023 00:32:40 GMT

We did see this issue today creating continuous alerts for this BIOC rule for almost 2 hours. The community sharing really helped.

Re: Multiple events "A Successful login from TOR"

Syedfaheem — Tue, 28 Mar 2023 07:29:18 GMT

We did receive similar alerts, upon contacting PA Managed Threat Hunting team and PA support team, they confirmed officially that it was a false positive as the Analytics Detector got updated.

Re: Multiple events "A Successful login from TOR"

MartinPfeil — Tue, 28 Mar 2023 07:35:21 GMT

Same problem, based on the replies here I regard it as a false positive

Re: Multiple events "A Successful login from TOR"

Syedfaheem — Tue, 28 Mar 2023 07:49:47 GMT

However, I am in touch with PA support to get an update on this issue.

Re: Multiple events "A Successful login from TOR"

anlynch — Tue, 28 Mar 2023 15:42:45 GMT

Hi everyone,

I wanted to give a quick update on the situation that started yesterday. The issue was caused by a misconfigured analytics detector which resulted in several false positives over a short period of time. A more detailed email will be sent out to customers at a later time. As of now the issue has been handled and everything is working as expected.

We apologize for any issues this may have caused.

Have a great day!