malware

Hola, detectamos esta URL que es un malware indevafd.com 

False Positive? PDQ and virus win32.wgeneric.bdakpv

After installing a fresh version of PDQ Deploy and/or PDQ Inventory, got two threat notices of this, from our PDQ server to one of our servers it is supposed to scan.Thinking it is a false positive.

Virus/Win32.WGeneric

win32.wgeneric.bdakpv

Host sweep alert from an iPad

We have an iPad that is triggering our scan block policy as a host sweep. The iPad is attempting to connect to one external (Internet) IP over port 443. It's happened for the past few days to a different external IP each time.

Threat vault info.

Name:

Virus/Win32.WGeneric.ajtozf / ms-ds-smbv3

We have been seeing alot of detections for smbv3 for file detections varying from pdf to any office document. Wildfire has been picking up the traffic, marking it as Threat and either resetting it or alerting on in. This monthly only we have had abou

Syslog to exclude BYOD subnets from logging

Hi all , We do have a few questions on Logging. 

1. Can we exclude the BYOD subnet from alerting as they flooding us with irrelevant logs. (both URL and Threat monitoring)

2. Can we exclude some category in URL from sending syslog messages. Example he

ssl forward decryption not work with URL category (proxy-avoidance-and-anonymizers )PAN 10.0.5

I upgrade from Pan os  9.1 to 10.0.5 and i foud some issue in any proxy website with URL category (proxy-avoidance-and-anonymizers ) like https://www.proxysite.com/  it  bypass any blocked traffic even with ssl decryption policy ,however other catego

pa3220 POS 9.1.5

howdy,

The short question is a block country rule on 1/8 the thing to do?

or  a white list of ip? and apps?

Thank you

Mike

2960X - WAN and DMZ on same switch separated by vlans?

the title says it pretty much. Trying to consolidate a 24 port switch that only uses 3 ports with another 24 port that is only using 2 ports.

How safe/comfortable would you be if you used the same switch for DMZ and WAN traffic, but separate them b

DNS Tunneling

Im trrying to detect dns tunneling with custom signatures.

i have some snort rules to begin.

some of you have any strategies for this?