topic Is PA capable to scan for malware in Activesync/Outlook365 traffic? in General Topics

Is PA capable to scan for malware in Activesync/Outlook365 traffic?

JoseCortijo — Thu, 08 Jun 2023 15:35:16 GMT

Hi,

We have PA-850 appliances with Wildfire and AV licenses.

Recently we enabled the decryption of email traffic and now we are dealing with the data protection officer, he is asking us to detail what exactly is being inspected.

At first I thought all attachments and URL were inspected. But then I found some information about link analysis only happening for SMTP traffic.

https://docs.paloaltonetworks.com/advanced-wildfire/administration/advanced-wildfire-overview/advanced-wildfire-concepts/email-link-analysis

For file analysis, I could not find any mention about the application protocol supported.

https://docs.paloaltonetworks.com/advanced-wildfire/administration/advanced-wildfire-overview/advanced-wildfire-concepts/file-analysis

We are using Microsoft native protocols (activesync, ms-exchange,office365,...) and mapi-over-http and rpc-over-http. SMTP is not allowed because security reasons.

I assume that files transferred using HTTP are being scanned, but what about if a file is transferred using any other protocol? is Paloalto doing something?

thanks

Re: Is PA capable to scan for malware in Activesync/Outlook365 traffic?

OtakarKlier — Thu, 08 Jun 2023 20:54:06 GMT

Let me caveat this by saving the PAN already must have a detection signature for it. Meaning it will not scan/send attachments to wildfire, etc.

Hello,

Yes if the traffic is not encrypted. But also not guaranteed. For email traffic its best to utilize an actual email scanning appliance or service. I would go with an online scanner rather than an onsite appliance for several reasons.

Regards,

Re: Is PA capable to scan for malware in Activesync/Outlook365 traffic?

JoseCortijo — Fri, 09 Jun 2023 10:18:38 GMT

Thanks for your reply. I performed tests accessing with outlook client and OWA, both decrypted flows. I can confirm that via HTTP the virus is detected and the connection reset. Via outlook, the virus travels safely until the destination mailbox 😉 so it is consistent with the documentation, PaloAlto does not inspect Activesync or any other MS email protocol.

thanks!