Help with Microsoft DCE RPC Big Endian Evasion Vulnerability 33510

I have Googled this and read up on numerous links, but I cannot find anything of value on this threatID. I have 30-40 events a day from various IP addresses on my network, usually 1 event per IP, sometimes 2 events. I have scanned several of the PC's with 3 different popular scanners, nothing found. I have monitored the traffic from the PCs an...

Blocked URL's are not getting blocked anymore

I configured a URL filering profile that doesnt filter any topic & just blocks 2 URL's as a test. This was working a few days ago but stopped. There have been no new changes commited since & the security policy is still in the same order. Even looking at the policy it makes no sense why this is not working. I have a security profile ...

Threat blocked by Palo Alto: Is there anything else to do?

Hi, When the Palo Alto blocks a communication that is flags as a threat (ie: SQL Injection, XSS, etc.), should we investigate the target IP to make sure that the threat was blocked? The reason I'm asking is that whenever the Palo Alto blocks an attack from an IP address (Session End Reason is "threat"), if we go in the "Traffic" view, we can see...

Dynamic IP lists and FQDN?

The only type of external dynamic list i appear to be able to specify in my firewall policy is a dynamic IP list (not a dynamic domain list). And the formatting of such lists appears to be purely for IP addresses. So my question is, how can i specify fully qualified domain names in a dynamic list usable in a firewall policy?

Recommended MineMeld prototypes/miners?

I defined two miners - Alient_Vault_Reputation and Bambenek_Consulting - and assigned them to the appropriate processor and output. I then added them to a global deny rule in PA. Are there any other recommended prototypes with a high reputation to add as a miner for blocking IPs? Thx

URL Filtering Team creating MORE of a risk

Hi all, Does anyone know how to directly interact with the URL filtering team besides urlfiltering.paloaltonetworks.com? I would especially like to reach a manager. I am having huge problems with them. I keep submitting sites on which scanners have found malware (usually after one of my users visits them) and they keep refusing to recategoriz...

How to avoid and prevention about CVE-2018-11776 with palo alto firewall

Hi Expert , Please suggest to me about how to avoid CVE-2018-11776 what are affecting about this vulnerability also palo alto firewall can detect or prevent CVE-2018-11776 ? Thank you

SSL DERYPTION : How to automate URL/domaine decryption Exclusion properly?

Use case : Ours users go through Palo alto for internet access. Decryption feaures has been enabled.When users try to access to internet may failed because the decryption-error.We need a solution to automate URL SSL decryption exclusion and log urls excluded for review. Perfectly in a dynamics external list or in a custom url category. Theses dy...

How Palo Alto Networks Identifies GnuTLS Server Hello Session ID Heap Buffer Over Without Decryption

HI All, We detected Vulnerability: 36926 ID- GnuTLS Server Hello Session ID Heap Buffer Overflow in Palo Alto firewall. In our cutomers Firewall enviroment we not enable the SSL Descryption Feature. Customers Queries us.. How and Why Palo Alto able detect the Vulnerability threat without the SSL? Can Any one assist us on this?

PAN-DB Connectivity

Hi, We are faced with the connectivity issue when we tried to download the URL filtering DB from PAN-DB. As the firewall has an external interface to the internet, we have changed the service route for “Palo Alto Networks Services” to the external interface. However, we are not able to get connected to the PAN-DB. We are able to ping to the PAN-...

how to integrate x force free feeds with minemled?