topic Re: block http download based on the download file hash value in General Topics

block http download based on the download file hash value

nextgenhappines — Wed, 14 Oct 2015 15:37:27 GMT

Dear all,

I have asked to look for a solution, we want to receive alert based on specific file download via http, we have the file MD5 or SHA1 hash value. Can I do this with a PAN? The filename could change, I don't know the file size but I have the file hash value..

Thanks for your helps in advanced,

Re: block http download based on the download file hash value

pankaku — Wed, 14 Oct 2015 16:04:35 GMT

If you want to block/alert a file with hash value it is not possible.

Re: block http download based on the download file hash value

reaper — Thu, 15 Oct 2015 09:31:05 GMT

Hi E

The Palo Alto Networks firewall performs stream-based inspection of file transfers, so no proxy functionality is applied, hence no sha or md hash is collected. We can, however, identify files by all kinds of other means. Could there perhaps be any other identifiable markers, watermarks, headers, propietary strings of data in the file? these could be easily added to a custom app or threat profile, or as a data filtering profile.

regards

Tom

Re: block http download based on the download file hash value

rmonvon — Tue, 20 Oct 2015 20:47:08 GMT

Hi...One option is to use WildFire subscription to upload all interesting file to our WildFire cloud for analysis. From its portal you can see all the files and find the file to match your MD5 hash.