Trouble with Custom MSRPC Based AppID

I am trying to create a number of custom MSRPC based App's using the msrpc-req-bind-data contact. I have set msrpc as the parent app, dynamic TCP and UDP for the ports, and the signatures are set to the session scope. I pulled the hex for the BIND re

What type of regular expressions are used in Data Patterns?

Hi everyone,

Im curious to find out what type of regular expressions are used in the data pattern portion of the Palo Alto? One discuission mentioned that it was perl based but some things do not work. Can anyone point me in the right direction?

Thank

Perl Scripting to FW

So I got help from support and they gave me this nifty Perl example on how to get output from the firewalls.

However, I need to assign that output from the show command to a variable for further manipulation.  That was the whole purpose.

Does anyone kn

Data Leak Protection, searching for passwords.

Does anyone use data filtering for passwords discovery? Basically i want to know and stop if possible when someone logs into their external email service like Google Email and upload say a passwords.txt file full of usernames and passwords OR inputs

WebServices SDK Download

I have been going through some documents which mention the Palo Alto WebServices SDK tool that can use the API to backup and perform basic reporting tasks. Is this tool still available for download? Cannot find the download links anywhere...

CloudStack Palo Alto Plugin Enhancement Opportunity

Hi All,

We are looking for developers involved in the CloudStack Palo Alto Plugin to add some required functionality. Assuming the price is right, we are happy to engage one of the developers to implement this for us to speed up the features that we n

Script to restart management server process on firewalls

Hello All,

I have a hot case(248797) where customer has upgraded panorama from 5.1.x to 6.0.x where in log forwarding process has stopped from firewalls after upgrade.

After some troubleshooting I did notice that firewalls show as connected but below c

custom signature

Hi,

I am trying to making a custom signature. I am trying to make it using the the context gdbremote-req-context for the tcp stream as seen below. Is this the correct methodology or should I be using something different?

This is for IBM Netezza. A data

Phone Number Regex

Hello team! I hope everyone is doing great. I have a customer who wants to use Data Pattern Regex to block phone numbers with 10 digits or more, I've been doing research and contacted some of our engineers but have not been able to get to do it. Can

Bradford and PA for user ID

Is there a way Bradford box can be used to talk to PA-500 so that we can have user identification on the PA: something other than MAC or IP?

Crazy Browser-RegEx Help

Does anyone know how I can block all traffic coming from "Crazy Browser" clients. Our OWA accounts keep getting hacked and the IIS logs indicate this could be the method. Can you creaet a custom sig based off user agent string ? Any ideas ?

Thanks!

Tom

Blocking credentials from being submitted to a malicious site

Hi all.  We are trying to come up with a way to prevent our users from entering their credentials on bogus websites.  The problem starts with a phishing email being received that contains a link to a malicious site and asks them to log in or update t

Custom Application Signature

Hi All,

I want to ask about custom application signature

So i got an issue for this application.

when i see in the monitor traffic log the Application will be capture as Oracle

This oracle application is generalization for all of client application oracl

none

none