app-id changed for mssql-db-base

L4 Transporter

app-id changed for mssql-db-base

We just noticed that what used to show up as mssql-db-base is now showing as mssql-db-unencrypted. Yep, this is internet stuff that we know is not encrypted so that makes sense and the first thing I did was check to see if there wasn an app-id update that may introduce this change but I do not see anything that would impact that. Has anyone else seen this? Am I just missing where this was updated?


In the screenshot you can see when the change happened and a few mssql-db-base straggers are still there but now its all showing as unencrypted


2018-09-26 15_29_15-a little digging - Message (HTML).png

The dynamic updates are around 11am on the 25th for the MS JET DB vulnerability and prior to that the last update we had was on the 17th. Looking at the system logs for around 2:30 am there were no updates installed other than URL DB and the 5027 content update that contains the JET DB reset-both update.


This is nto causing any issues but does stand out as something that changed so I wanted to reach out to the community and see if anyone has also seen this and could shed some light on where this app-id change came from.



L1 Bithead

Re: app-id changed for mssql-db-base

Looking at my notifications from, Applications and Threat Content Release Notes for Version 8067 on 9/19 include a section regarding this:
Palo SQL update.png


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!