topic Re: URL Filtering - Dynamic Updates in Advanced Threat Prevention Discussions

URL Filtering - Dynamic Updates

roma — Tue, 06 Aug 2019 18:47:32 GMT

Hello,

We have URL filtering with the PAN-DB license. If a URL is determined to be malicious, (from other URL checking websites, but not from Palo Aloto's yet, since they only categorized it as high risk and unknown at the moment). What is the best way to make sure users will be blocked from it? We are blocking the categories of hacking, malware, phishing and C&C.

Do I add it to my URL filtering block list on the Palo Alto firewall?

I submitted the URL to the Palo Alto website to test it and I requested a change for it to be categorized as phishing, but I received an email back that I would be notified in 24 hrs.

What is the best way to make sure users will not reach a site that is malicious but PA Networks hasnt classified it as that yet?

Thanks,

Re: URL Filtering - Dynamic Updates

OtakarKlier — Tue, 06 Aug 2019 21:10:54 GMT

Hello,

There are several options including but not limited to:

Block High Risk and Unknown categories (this is best practice)

Block the specific URL

https://docs.paloaltonetworks.com/best-practices/9-0/internet-gateway-best-practices/best-practice-internet-gateway-security-policy/create-best-practice-security-profiles.html#id17A29C0201H

Regards,

Re: URL Filtering - Dynamic Updates

roma — Tue, 06 Aug 2019 21:17:26 GMT

Thank you, when a URL is submitted to Palo Alto for reclassification - how long does it usually take for them to take action on that?

Re: URL Filtering - Dynamic Updates

OtakarKlier — Tue, 06 Aug 2019 21:19:54 GMT

Hello,

I've had it done in less than an hour a few times and sometimes days. It depends on how busy they are on the backend. Humans review the submissions, if I remember correctly.

Regards,