topic Re: Unknown File Types in General Topics

Unknown File Types

Hithead — Fri, 08 Aug 2014 11:29:16 GMT

Hi all,

we like to block or be alert when the file types .edrw and .easm (eDrawing) are passing the PA. Currently nothing is shown in the Monitoring Data Filtering.

Any idea how to get PAN to update file types in security profiles? Can I somehow report it to PAN?

Re: Unknow File Types

reaper — Fri, 08 Aug 2014 11:51:30 GMT

to have these filetypes added to the file blocking known filetypes you can reach out to your Palo Alto Networks SE to have them added in a feature request for our engineering and product management team to consider.

In the meanwhile you could go ahead and build a custom signature to match attributes common to these types of files (like any strings that would appear in the file) and have them blocked by means of threat prevention

this doc should be helpful: Creating Custom Threat Signatures

regards

Tom

Re: Unknow File Types

Hithead — Mon, 11 Aug 2014 07:21:18 GMT

Hi,

this means, if we are transfer 'PA unknown' file types, we will never be able to log and recognize it?...sad.

Re: Unknown File Types

SDorsey — Mon, 11 Aug 2014 13:00:22 GMT

You can log and recognize it if you create a custom threat signature.

I don't believe the PA identifies files solely based on the file extension.

Re: Unknow File Types

Hithead — Mon, 11 Aug 2014 14:04:46 GMT

I have so many policies, zones etc. For example the internet has so many of custom signatures. So how I have to detect them?

Also I like to see all data traffic in the Data Filtering Monitoring tab...

BTW: Could someone help me to create the custom signature for the both file types written in the first post?

Re: Unknown File Types

Hithead — Tue, 12 Aug 2014 11:27:35 GMT

Hi,

created a custom signature, but I cannot define client2server or server2client. I like to block only uploads but PA is blocking both... could you please take a look?

both (NOT one of them) pattern of this file type should match:

Our profile (add the custom object as exception):

Thx in advance!