topic Re: PanOS 10.1.14-h2 - How does Palo identify if traffic belongs to an 'ms-update' application flow in Next-Generation Firewall Discussions

PanOS 10.1.14-h2 - How does Palo identify if traffic belongs to an 'ms-update' application flow

jebwilson — Wed, 17 Jul 2024 14:18:23 GMT

I need to understand exactly makes a TCP flow identified as the 'ms-update' application.

I found the Objects -> Applications -> ms-update app description. It shows the ports used, and other dependencies. But this does not explain exactly what makes one flow identified as the 'ms-update' application. And a second flow identified as some other application.

Details on this topic would be appreciated. Especially any info about specifically what parameters go into the decision to classify a flow as the 'ms-update' application. Thank you.

Re: PanOS 10.1.14-h2 - How does Palo identify if traffic belongs to an 'ms-update' application flow

TomYoung — Wed, 17 Jul 2024 16:09:13 GMT

Hi @jebwilson ,

The primary method PANW uses to identify applications is application signatures. PANW does not reveal the specific details for each signature to my knowledge. In some cases, protocol decoders and heuristics are used. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/app-id-overview

Here is an example where App-ID has identified the traffic as ssl, but also uses the certificate to change it to a different app. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVSCA0

Enabling decryption will allow you to identify a lot more apps.

Thanks,

Tom

Re: PanOS 10.1.14-h2 - How does Palo identify if traffic belongs to an 'ms-update' application flow

jebwilson — Wed, 17 Jul 2024 18:54:44 GMT

Thank you Tom. Really appreciate the clear information and the quick reply!