app-id changed for mssql-db-base

hshawn — Wed, 26 Sep 2018 22:35:46 GMT

We just noticed that what used to show up as mssql-db-base is now showing as mssql-db-unencrypted. Yep, this is internet stuff that we know is not encrypted so that makes sense and the first thing I did was check to see if there wasn an app-id update that may introduce this change but I do not see anything that would impact that. Has anyone else seen this? Am I just missing where this was updated?

In the screenshot you can see when the change happened and a few mssql-db-base straggers are still there but now its all showing as unencrypted

The dynamic updates are around 11am on the 25th for the MS JET DB vulnerability and prior to that the last update we had was on the 17th. Looking at the system logs for around 2:30 am there were no updates installed other than URL DB and the 5027 content update that contains the JET DB reset-both update.

This is nto causing any issues but does stand out as something that changed so I wanted to reach out to the community and see if anyone has also seen this and could shed some light on where this app-id change came from.

Re: app-id changed for mssql-db-base

jessica-davis — Wed, 26 Sep 2018 23:09:39 GMT

Looking at my notifications from updates@paloaltonetworks.com, Applications and Threat Content Release Notes for Version 8067 on 9/19 include a section regarding this:

topic app-id changed for mssql-db-base in General Topics

app-id changed for mssql-db-base

Re: app-id changed for mssql-db-base