topic Re: generic:beerwineandcupcakes in General Topics

generic:beerwineandcupcakes

rtesdall — Fri, 16 Nov 2012 03:52:11 GMT

Upgraded to PAN OS 5.0 last weekend, got home from the Ignite Conference and was looking through the Threat Logs and I see a bunch of entries for spyware based on DNS signatures (new feature in PAN OS 5.0). Is there anyway to find out more information about this? I know it says Generic in the name, so I'm guessing this is a broad category. It would be nice if there was something similar to the Applipedia for these new DNS signatures. Thanks for any suggestions, I am going to try and dig deeper into the the box that is throwing those log messages.

Re: generic:beerwineandcupcakes

onguard — Fri, 17 Jan 2014 04:33:25 GMT

I agree or at least a place to report false positives like generic:channahon.org which is a municipal site. Perhaps in the past they hosted malware but I cant imagine it being continuously either way I have no way of knowing.

Re: generic:beerwineandcupcakes

SDorsey — Sun, 19 Jan 2014 07:07:01 GMT

I struggle with this too. Hard to really determine what to look further into.

Re: generic:beerwineandcupcakes

apackard — Mon, 10 Mar 2014 10:53:21 GMT

Ditto this.

Is there currently any explanation of what the 'Categories' mean e.g. difference between Generic and Trojan-Dropper (the two I've seen so far, though I know the latter at least is fairly obvious!).

It would also be nice to be able to split the policy and block some and not others (based on category etc).

Rgds