Automation/API Discussions

Can't connect to GlobalProtect

We recently implemented the solution GlobalProtect solution. Connect method is pre-logon. One of the users is unable to connect. Here are the logs.(T2984) 08/05/15 12:09:24:550 Debug(3468): prelogin to portal result is (null)(T2984) 08/05/15 12:09:24:550 Debug(3573): Failed to pre-login to the portal xxxxxxxxx. Error 0(T2984) 08/05/15 12:09:24:5...

Creating Custom App-ID for an unknown TCP session that is encrypted or doesn't seem to have a pattern.

How do i create a custom App-ID if i can't see any pattern on the captured packets? The pcap data seems to be encrypted. For example, i was trying to create a custom app-id for the game Clash Of Clans and i can't seem to find any pattern at all.

App-ID to trap iodine (DNS tunneling)

Hi All,I'm trying to create a custom signature to block iodine usage of DNS.while doing a packet capture on it i spotted a returning set of values in the hex that would allow me to capture this traffic.but i am not experienced enough to get this into an App-ID and am looking for help.as can be seen below in the screenshot my goal would be to cap...

Custom threat signature to detect/block DNS TXT requests.

I'd like some help creating a custom threat signature that would would detect/block DNS TXT requests similar to threat signature ID:34842 which detects DNS ANY Request.The goal is to disable DNS Queries regarding TXT resource records from our LAN to the untrust network. We had an internal security audit done where they were able to tunnel out t...

Resolved! POST Data in a form

Greetings DevCenter,I am trying to write a custom application that will prevent specific data in an HTTP Post. In the attached trace, I would like to block the phrase 'THISISATEST' in the POST but allow any other phrase. (In reality I would also key in on several other headers to make it site specific, but I am not having problems with that part...

Detecting and blocking SSLv2

Need assistance creating a custom vulnerability signature to detect SSLv2.Thanks

Enable/Disable security rules via XML API

Hi all,is it possible to enable / disable an existing security rule via XML API ?Looking at the documentation (both the XML config guide and the api on the firewall) I found no useful informations on this topic thank's !

Custom Captive Portal Page

I am creating a custom captive portal page. As part of my page, I would like to pass the username and password as hidden values so that all a guest user would need to do is to click on the button to accept the terms and authentication to occur with the variables that will be passed along. Is something like this possible? If it is, are there an...

Regex Pattern for Data Filtering

Hi,I am trying to build a regex pattern to detect the following file types. Link is below.The files types end with the extension .v and at the end of the file will always have the words endmodule.If anyone has had experiance with this it would be greatly helpful for your insight.Thanks! http://asic-world.com/code/hdl_models/syn_fifo.v

Patterns in custom app signature only recognizing half the tcp port traffic

Hello All,Kind of at my wits end. I could sure use some assistance.I have created some custom app-ids with signatures with success that recognize 100% of the traffic and other app-ids with signatures that fall short.The ones that fall short only recognize 50% of the traffic with other half labeled as "Insufficient data."The description that I am...

Regex for custom vulnerability signature - help needed

Hi,I'm not a regex expert, and I'm struggling to figure something out.I'm making signature that looks at the "Referer" in the http-requst-header. I've managed to build an expressions that matched on "Referer: http://cnn.com", that looks like this: ".*(Referer: http://cnn\.com)"What I want to do next is make an expression that matches on everythi...

keep getting the following error "is invalid. Syntax error at end of input."

Customer implementing the following Regex for Data Patterns and is getting syntax error. (0[1-9]|1[012])\-(0[1-9]|[12][0-9]|3[01]\-(19|20)\d\d Need help to get the correct regex pattern.

Resolved! Create a URL filter for an arbitrary string?

Hello,I'd like to create a URL filter to block/deny any URL that has an arbitrary string in it.I was referred to this forum by Palo Alto Support.In this specific case, the string I'd like to block is "Automated_Clearing_House_transaction".How can I do this?Thanks,Matt

Unable to execute custom-dynamic-report (502 bad gateway + Unauthorized request)

I'm trying to create and execute a completely dynamic report as described in 2.5.3 Custom reports in this XML API documentation [1]. This reporting is being performed on a panorama running PANOS-6.0.3.When I try to download a report I get the following error (I've tried a few different methods of URL encoding as curl doesn't like the [ and @ cha...

Youtube Edu

We want to allow youtube edu videos for everyone on our network, but still block youtube for students. Youtube has a set up walkthrough that helps, but I need some assistance thinking this through. So any assistance would be helpful. I have posted the directions below...PrerequisitesIn order to access YouTube for Schools you will likely need ...

Discussions

Can't connect to GlobalProtect

Creating Custom App-ID for an unknown TCP session that is encrypted or doesn't seem to have a pattern.

App-ID to trap iodine (DNS tunneling)

Custom threat signature to detect/block DNS TXT requests.

Resolved! POST Data in a form

Detecting and blocking SSLv2

Enable/Disable security rules via XML API

Custom Captive Portal Page

Regex Pattern for Data Filtering

Patterns in custom app signature only recognizing half the tcp port traffic

Regex for custom vulnerability signature - help needed

keep getting the following error "is invalid. Syntax error at end of input."

Resolved! Create a URL filter for an arbitrary string?

Unable to execute custom-dynamic-report (502 bad gateway + Unauthorized request)

Youtube Edu

Output format for test/url-info-cloud and test/url-info-host

Wildfire API "Missing required field apikey"

Auto de-register devices in Panorama

Rest API not seeing template variables

Devicegroup hierarchy dump

Unlock your full community experience!

Resolved! POST Data in a form

Resolved! Create a URL filter for an arbitrary string?