topic Re: Testing Log4J with AWS Cloud NGFW in Cloud NGFW for AWS Discussions

Testing Log4J with AWS Cloud NGFW

mderaet — Wed, 20 Jul 2022 08:31:55 GMT

Hi,

what is the curl command in AWS EC2 to test if Log4J is well blocked by my AWS Cloud NGFW?

Re: Testing Log4J with AWS Cloud NGFW

dtaneja — Wed, 20 Jul 2022 19:23:45 GMT

Hello @mderaet

Greetings from Palo Alto Networks!

I saw your post and here is the curl command please make changes based on your environment IP address.

Below is the video link which explains CloudNGFW implementation against the Log4j attack.

https://youtu.be/OovXk4WF7vs

Regards,
Devanshu Taneja
Product specialist
Palo Alto Networks
https://live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW
*Don’t forget to accept the solution provided!*

Re: Testing Log4J with AWS Cloud NGFW

mderaet — Thu, 21 Jul 2022 08:24:01 GMT

Hey Taneja,

that would be lovely if I can copy the command as it is not possible. It seems you gave me a picture?

Re: Testing Log4J with AWS Cloud NGFW

dtaneja — Thu, 21 Jul 2022 16:29:50 GMT

Hello @mderaet

Greetings from Palo Alto Networks!

I apologize I was having an issue pasting the command here.

Please find the pdf file attached to this post which contains the curl command and please make changes in the command based on your environment IP address.

Below is the video link which explains CloudNGFW implementation against the Log4j attack.

https://youtu.be/OovXk4WF7vs

Regards,
Devanshu Taneja
Product specialist
Palo Alto Networks
https://live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW
*Don’t forget to accept the solution provided!*

Re: Testing Log4J with AWS Cloud NGFW

mderaet — Sat, 23 Jul 2022 11:54:42 GMT

Hey Taneja,

it does not work

So I would like to open a support case (I have premium support) and have a zoom meeting monday to solve this.

Thanks

Re: Testing Log4J with AWS Cloud NGFW

mderaet — Sat, 23 Jul 2022 11:55:30 GMT

I would like to give you more details on this but impossible with the chat box here.

Re: Testing Log4J with AWS Cloud NGFW

mderaet — Sat, 23 Jul 2022 14:05:40 GMT

I launched this curl to an external web server (a colleague of mine) and the curl is successfull!!

In cloudwatch I can see the rule which allows this curl.. Isnt Log4J attack blocked by default?

Please advise

Re: Testing Log4J with AWS Cloud NGFW

dtaneja — Mon, 25 Jul 2022 17:27:48 GMT

Hello @mderaet

Greetings from Palo Alto Networks!

Log4j attack is blocked by default in CloudNGFW please make sure your CloudNGFW security profiles are set to Enabled (Best Practice).

Please refer to the below link for your reference.

https://docs.paloaltonetworks.com/cloud-ngfw/aws/cloud-ngfw-on-aws/rules-and-rulestacks/security-profiles

Regards,
Devanshu Taneja
Product specialist
Palo Alto Networks
https://live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW
*Don’t forget to accept the solution provided!*