topic Dynamic Block Lists and IP's in General Topics

Dynamic Block Lists and IP's

jmayne — Sat, 24 Aug 2013 15:09:14 GMT

I saw this line in an article about Dynamic Block Lists.

"as our threat team identifies malware, they automatically take any URL or IP associated with that threat and will include it as part of the PAN-DB URL filtering database. "

Does this mean that the PAN-DB contains all the IP's that the URL's resolve to? I would not think so since that one IP may have legitimate URL/URI's associated with it. Can someone clarify?

Thanks,

Jim

Re: Dynamic Block Lists and IP's

HULK — Sat, 24 Aug 2013 17:32:55 GMT

Hello Jim,

URL categorization takes advantage of a URL filtering database on the firewall that lists the most popular URLs and other URLs for malicious categories. The URL filtering database may be able to resolve requests that the local database is unable to categorize. The default is enabled when using the BrightCloud database. When using the PAN-DB, this option is enabled by default and is not configurable. PAN-DB will not contain all the IP's that the URL's resolve to.

To configure the system response when a URL remains unresolved after a 5 second timeout period, use the Category and Action settings in this window. Select the action for the category “Not resolved URL.

Thanks

Re: Dynamic Block Lists and IP's

UhMayYeah — Sat, 24 Aug 2013 22:47:35 GMT

The statement is TRUE only for malware URLs /IP addresses identified by the PA Threat Research Team.

PAN-DB does not contain all the IPs associated with a URL.