topic O365 sub-applications in General Topics

O365 sub-applications

theonewhoknocks — Fri, 01 Mar 2019 11:14:27 GMT

Currently, our palo alto only detects the following O365 applications

*ms-office365

*outlook-web-online

*sharepoint-online

*ms-office365-base

*ms-teams

*ms-lync-online

Do we need to enable SSL decryption so that it can detect other sub-applications? (ms-downloading, ms-uploading, ms-posting, etc.)

Re: O365 sub-applications

OGMaverick — Fri, 01 Mar 2019 12:37:21 GMT

Yes

Re: O365 sub-applications

BPry — Sat, 02 Mar 2019 20:57:05 GMT

@theonewhoknocks ,

To expand on the correct answer of @OGMaverick; the firewall can't actually identify any of the more specific app-ids unless it can actually inspect the full traffic via decryption. Without decryption, the app-id process is really "best-effort" practice and you'll miss out on the finer controls that you would have had access to if decrypting the traffic.

Re: O365 sub-applications

Infrastructure_TBS — Wed, 03 Apr 2019 18:49:13 GMT

If we decrypt O365 traffic, can it "see" the file names of the files being transmitted? Right now we are using an Exchange solution, that even if the traffic is decrypted, the firewall cannot "see" the files, so in the monitor there is no indication that a file was attached to an email, that would be something we would like to implement.