topic Re: spam-urls ? in Advanced Threat Prevention Discussions

spam-urls ?

notes01 — Tue, 20 Jun 2017 08:45:21 GMT

Running PAN-OS 6.1.15 and content 709, when I filter for "spam-urls" (a category that I wasn't really aware of previously), Panorama returns "extremism" hits. Am I missing a trick here or is something broken?

Re: spam-urls ?

acc6d0b3610eec313831f7900fdbd235 — Tue, 20 Jun 2017 13:47:53 GMT

Hi @notes01

Are you using the BrightCloud URL filtering subscription or PAN-DB?

Re: spam-urls ?

notes01 — Tue, 20 Jun 2017 14:28:55 GMT

Hi, we're using the PAN-DB; "extremism" was a new category in that last August.

Re: spam-urls ?

acc6d0b3610eec313831f7900fdbd235 — Tue, 20 Jun 2017 16:43:16 GMT

Hi @notes01

I just installed the 6.1.15 in my lab, with content 708 and the reason you are seeing the category spam-urls, is because you are using BrightCloud URL filrtering and not PAN-DB. Spam-urls is a category that only exist in BrightCloud.

Because you are using Panorama, I would recommend that you confirm if you are using the same URL filtering subscriptions (Enabled) on both ends because the spam-urls category belongs to BrightCloud, and Extremism is only present in the PAN-DB, which as you mentioned was included last August as part of the content update 602.

BrightCloud SPAM-URLs Category

As I am sure you are aware, there's have been issues with content 709, and it has been pulled out of the dynamic update website. The current recommendation is to stay with whatever content update you were running before the release of 709.

https://live.paloaltonetworks.com/t5/Customer-Advisories/UPDATED-06-19-Important-information-regarding-Content-Apps-amp/ta-p/161418

Let me know how it goes.

Willian

Re: spam-urls ?

notes01 — Fri, 30 Jun 2017 13:47:49 GMT

Thanks for the pointer - we used to use BrightCloud but switched to PAN-DB a couple of years ago. I've checked through Panorama and the firewalls and everything is correct.

The first sight I had of the category was in a daily report that Panorama generates; at first I didn't think much about it but later, piqued by this, I then tried it as a log filter. Even though we often get hits on "extremism", I'd never seen that category in the report and clearly it's coming up with "spam-urls" instead.

It would be interesting to see if the behaviour can be replicated. It's not security-shattering stuff though, low priority in my book.