Advanced Threat Prevention Discussions

Welcome to the Threat & Vulnerability Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Why are APPID and Threats not Separate Updates?

Don't tell me how to fix this, I already know how it works. I need to know why Palo Alto does not have a separate APPID update and Threat update just like AV and WF are separate. Using PA as an everything device we actually need Vulnerability and Antispyware to be separate as well.

How to test DNS Security Properly?

In reading up on DNS Security I found that URL's provided for testing in the following document, Enabling DNS Security, do not accurately ensure DNS Security feature license is installed and configured. A very accurate indicator of this is that all of those URL's are adequately blocked on a firewall running PAN-OS 8.1.x due to the PAN-DB URL fil...

PAN-SA-2019-0013 Mitigating Control

Does restricting the management interface from external exposure reduce the likelihood external exploitation of this vulnerability?

DNS logs

Is there a way to view and/or log dns queries and responses (outside of anti-spyware rules)? The passive DNS telemetry configuration seems to do what we want but those fqdn to IP mappings are sent to Palo and it doesn't appear that we can view what fqdns resolve to what IPs in the logs. This doesn't appear to be a feature in the dns proxy object...

Resolved! stop dns tunnneling

what config i need to stop dns tunneling on the PA?

Traps CVE-2019-0708

Does Traps offer protection against CVE-2019-0708 ?

Credential Phishing Protection troubleshooting

hey community - tearing my hair out here...I've set up a RoDC in my environment and added a test group to the allowed password replication group. I've configured the user and credential agents on the RoDC and they say connected to my firewall, and also successfully connect to the other dcs. I can see my user to ip mapping for my test account....

New signature for polarbearrepo ( new zero-day from SandboxEscaper)?

As far as I can tell there isn't a CVE for this yet, but I would guess there will be one pretty soon. Hoping that Palo Alto is working on a signature as I write this, since SandboxExcaper released a POC...

Resolved! CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

Hi,just wondering on expected release for signature for this Vulnerability? CVE-2019-0708 - Remote Desktop Services Remote Code Execution Vulnerability Details here:https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708 regards Paul

Resolved! PAN signatures for Oracle WebLogic Deserialization Vulnerability CVE-2019-2725?

Any idea if/when PAN may be providing signatures for the new Oracle WebLogic Server deserialization vulnerability (CVE-2019-2725)? https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html

port scan and flood traffic

We are currently using the default "allow" on port scan (including openvas) and udp flood, since that is the default. Is there any reason not to block those threats?

Resolved! Cobalt Strike Potential Command and Control Traffic(18927)

Anyone seeing this new signature as FP prone?

Block OLE embedded document

Can PA file blocking profile be used to block OLE embedded documents Thanks

Community or News Group that has taken Snort signatures and converted them to PaloAlto

This is a very easy question for everybody. A lot of people have most likely created custom signatures from Snort or otherwise to apply to a PaloAlto firewall. Does anyone know of a news group or community in which those signatures have been converted and that you can download free of charge? Also, does anyone know of a list that (to the best...

Case #01083646: Unexpected behavior: WF-500 Failed to update content

Disk-space on the WF-500 was full and conent updates have been failing. The commands below were used to resolve the issue: delete wildfire-metadata update panup-all-wfmeta-<release> request wf-content upgrade check request wf-content upgrade download latest After doing so when running the command: request wf-content upgrade install versi...

Discussions

Welcome to the Threat & Vulnerability Discussions!

Why are APPID and Threats not Separate Updates?

How to test DNS Security Properly?

PAN-SA-2019-0013 Mitigating Control

DNS logs

Resolved! stop dns tunnneling

Traps CVE-2019-0708

Credential Phishing Protection troubleshooting

New signature for polarbearrepo ( new zero-day from SandboxEscaper)?

Resolved! CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

Resolved! PAN signatures for Oracle WebLogic Deserialization Vulnerability CVE-2019-2725?

port scan and flood traffic

Resolved! Cobalt Strike Potential Command and Control Traffic(18927)

Block OLE embedded document

Community or News Group that has taken Snort signatures and converted them to PaloAlto

Case #01083646: Unexpected behavior: WF-500 Failed to update content

Upgrade from Basic Threat Prevention to Advanced Threat Prevention

PAN-OS logs

Are there signature release for following vulnerabilities?

Cannot update Adobe Creative Cloud

App & Threat Content Comparison Utility

Possible false-positive spike: Threat ID 99951 Inline Cloud Analyzed CMD Injection Traffic Detection

Unlock your full community experience!

Resolved! stop dns tunnneling

Resolved! CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability - Expected Signature

Resolved! PAN signatures for Oracle WebLogic Deserialization Vulnerability CVE-2019-2725?

Resolved! Cobalt Strike Potential Command and Control Traffic(18927)