Receiving too many alerts when a route or ISP link goes up or down.

Hello.

I have a Palo Alto PA-440

We have enabled path monitoring for our ISPs, with the destination address/monitor IP set to 8.8.8.8. The ping interval is set to 3 seconds, and the ping count is 5.

Additionally, we have configured and enabled system

Wildfire

Hello Team,

We have an alert in our Splunk for Palo Alto Wildfire with threat name as "Email Link". However checking, see both user and recipients are same for the alert log and don't see any such subjected email in our Email Gateway (Proofpoint).

Custom App-ID with just source and destination ip address

Hi,

I have some traffic on a tap interface that I would like to create an APP-ID to identify it in the monitor logs. This a seperate network with its own custom application and functions. I have done some pcap's and can't see distinct data that rel

App-ID through SSL Client Hello

Dear All,

i have gone through packet capture to create an App-ID for the the bellow traffic :

I don't get the respective traffic translated though.

Any thoughts why?

intermediate certificates

Hello everyone,

Is there a solution other than manually importing intermediate certificates into the Palo Alto Firewall (PAN-OS10.2.9-h1)?

Since there are weekly a few websites with this problem popping up.

I already know the import procedure tha

Blocking claudebot from scanning sites

Is it possible to create a rule/application (or if there is an existing one) to block certain bots from scanning websites behind the firewall?  I see the claude application, but I'm guessing this is more for outbound requests than for blocking the bo

Zoom phone custom signature thru: ssl-req-chello-sni

Hi everyone!

We are currently moving our phone system to zoom, and we had an issue with the zoom application, some of their traffic its categorized as an incomplete causing that some calls hang out, or don't ring, i downloaded the packet capture lo

Sending NFGW (Palo Alto) firewall logs to Cortex XDR.

I would like to know if it would be possible to send the logs to Cortex XDR, using Cortex XDR PRO PER ENDPOINT licensing? What would be the possible methods?

I know it is possible using Cortex Data Lake, but with Pro-GB licensing.

Palo Alto Threat Vault AntiVirus Signatures

Hi Community!

I wanted to better understand how Palo Alto ties it's detections with its Unique Threat ID to the Wildfire Virus Detections. 

For example, we have been receiving a steady amount of alerting for a Virus File and Palo Alto gives us th

Windows Update Delivery Optimization (WUDO) Custom App-ID

Just seeking a Custom App-ID for Windows Update Delivery Optimization (WUDO).

Brute Force GlobalProtect Portal via GP app

I'm looking for a way to define a custom signature that can detect brute force attempts on the GlobalProtect portal that aren't based on the portal login page. I already have ID 40017 - VPN: Palo Alto Networks SSL VPN Authentication Brute Force Attem

Can custom appIDs, without signatures, be applied directly to a security policy?

For this discussion, we created custom appID `myApp`, it has NO signature.

If `myApp` uses port 22, the port of another known app (SSH), then to use `myApp`, it must be applied to an App Override policy.

But what if `myApp` uses unique port 2121,

Palo Alto Reponse to CVE-2023-48795

Hi all! I am curious whether  anyone knows if Palo Alto has any made any response to CVE-2023-48795? This vulnerabilities has been out for awhile and other vendors have already provided some types of response however, I am not able to find one from P

We updated the dynamic antivirus database and threats, but it failed

I've been waiting for 3 days to get help !

My introduction is Mr. Dwi

From PT. Tabsolutions

Indonesia

This is my device

Device Name                      : PA-3020-PLN

Software Version              : 9.1.16

Globalprotect Agent        : 5.2.12

creation of custom app id

Hello everybody, i need to create custom app id in firewall for only gives access to get method while api call, but when i wrote signature i can not define the contex of the method in http request.Any help?