8.0 credentials phishing queries

apatel — Thu, 23 Mar 2017 20:27:50 GMT

Hello All,

I have case where in client is having set up the user-id without agent on DC. As per the document says that with this set up the only protection feature available is "Use IP User Mapping" under URL-filtering.

I am seeing that it is working partially. When I test the same with log in page on zoom, I am seeing that the URL log shows that the credentials detected however when I do the same test with could.sophos.com it is not showing the credentials detected tick. Both the time the sessions are getting decrypted. Can you please let me know what all logs that I can check for the same ? as the following document shows the logs to be checked when we have agent installed on DC :

https://live.paloaltonetworks.com/t5/PAN-OS-8-0-Articles/PAN-OS-8-0-PAN-OS-Phishing-Attack-Prevention/ta-p/129935

Re: 8.0 credentials phishing queries

RamBalaji — Tue, 19 Dec 2017 05:57:35 GMT

There is a note "The firewall automatically skips checking credential submissions for App‐IDs associated with sites that have
never been observed hosting malware or phishing content to ensure the best performance even if you enable checks
in the corresponding category. The list of sites on which the firewall will skip credential checking is automatically
updated via Application and Threat content updates."

in admin guide under Set Up Credential Phishing Prevention topic but not sure this is the reason or log which shows the reason.

with regards,

Ram

topic 8.0 credentials phishing queries in General Topics

8.0 credentials phishing queries

Re: 8.0 credentials phishing queries