topic Re: Adding IOCs to URL Filtering in General Topics

Adding IOCs to URL Filtering

eliang — Thu, 04 Aug 2016 02:33:29 GMT

Hi PAN Live Community,

If I add additional IOCs (URLs/Domains/IPs) to our current active URL Filtering Profile, how do I make those new IOCs take affect?

Besides committing the changes to the added IOCs, do I need to re-apply the this profile to the Security Policy (in the Policies tab?)

The reason I'm asking is because (if memory serves me right) I added the new IOCs to the current URL Filtering Profile, but I was still able to visit the sites I added to be blocked.

Re: Adding IOCs to URL Filtering

Raido_Rattameister — Thu, 04 Aug 2016 04:02:45 GMT

URL profiles are added to security policy.

Did you add those bad url's to URL profile blacklist window or you created new custom URL category and added them there?

If second option then did you change this custom URL category action to block inside URL profile?

Re: Adding IOCs to URL Filtering

eliang — Thu, 04 Aug 2016 19:46:07 GMT

I simply added new IOCs to the current URL Filtering Profile, which this profile is part of the current active Security Policy.

I just spot checked one of the sites to be blocked and I can still visit it.

Re: Adding IOCs to URL Filtering

eliang — Thu, 11 Aug 2016 18:47:46 GMT

Turns out, whover tuned our URL Filtering policy had everything on alert/allow. I used the predefined profile and everything is good.