spam-urls ?

L2 Linker

spam-urls ?

Running PAN-OS 6.1.15 and content 709, when I filter for "spam-urls" (a category that I wasn't really aware of previously), Panorama returns "extremism" hits. Am I missing a trick here or is something broken?

L4 Transporter

Re: spam-urls ?

Hi @notes01

 

Are you using the BrightCloud URL filtering subscription or PAN-DB?

L2 Linker

Re: spam-urls ?

Hi, we're using the PAN-DB; "extremism" was a new category in that last August.

Highlighted
L4 Transporter

Re: spam-urls ?

Hi @notes01

 

I just installed the 6.1.15 in my lab, with content 708 and the reason you are seeing the category spam-urls, is because you are using BrightCloud URL filrtering and not PAN-DB. Spam-urls is a category that only exist in BrightCloud.

 

Because you are using Panorama, I would recommend that you confirm if you are using the same URL filtering subscriptions (Enabled) on both ends because the spam-urls category belongs to BrightCloud, and Extremism is only present in the PAN-DB, which as you mentioned was included last August as part of the content update 602.

 

BrightCloud SPAM-URLs Category

Bright-Cloud-URL-SPAM.PNG

 

 

As I am sure you are aware, there's have been issues with content 709, and it has been pulled out of the dynamic update website. The current recommendation is to stay with whatever content update you were running before the release of 709.

 

https://live.paloaltonetworks.com/t5/Customer-Advisories/UPDATED-06-19-Important-information-regardi...

 

Let me know how it goes.

 

Willian

L2 Linker

Re: spam-urls ?

Thanks for the pointer - we used to use BrightCloud but switched to PAN-DB a couple of years ago. I've checked through Panorama and the firewalls and everything is correct.

 

The first sight I had of the category was in a daily report that Panorama generates; at first I didn't think much about it but later, piqued by this, I then tried it as a log filter. Even though we often get hits on "extremism", I'd never seen that category in the report and clearly it's coming up with "spam-urls" instead.

 

It would be interesting to see if the behaviour can be replicated. It's not security-shattering stuff though, low priority in my book.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!