listing signature script moved to GitHub

Hello,I have posted following thread and attached a python script before, but this has already been obsolete. Please don't use this.Listing all of vulnerability or phone-home signatureI posted the latest version to GitHub instead. The URL is as follows.TakaMyzw/List-of-Signatures · GitHubThe script will spend more than 10 minute since it uses op...

How to block a file based on Content Disposition?

Hello,We are trying to block specific files based on the content disposition. Using all the different context values for http traffic has proven ineffective. The issue is that we don't see the file name until the end of the file download. A screen shot of the packet capture is shown. Support has not been successful at providing me how to ide...

Using xml-api to import the ip-user-mapping into User-id agent !!

hi, dear Sir : I use the XML api of Palo alto firewall to import the user-ip-mapping into the user-id-agent. And I could find a file"XMLAPIUserIPMap.txt" in the agent's directory. And when I stop the User-agent service , I would find the import data would be saved into this file "XMLAPIUserIPMap.txt". And after I restart this service, these use...

Limiting number of recipients allowed per Email message

Hi all,I am looking for a way to limit the number of receipients allowed (rcpt to:) in an email message (smtp). Anyone done this already ? Ideas ? Custom Signature with smtp-req-rcpt-argument-length ?Thanks for inputRoland

Pipe commands to CLI with plink....

Hi,In my struggle to switch my captive portal rules on and off during the day I want to run a script to achieve this. I use a .bat file containing the following line:c:\test\plink.exe -ssh 192.168.100.2 -l admin -pw mypassword -m c:\test\enable.txtThe file enable.txt contains the following lines:configureset rulebase captive-portal rules "My Ca...

Email notification on sslvpn events using a Email Server Profile

Using a Email Server Profile a customer would like to get reports on sslvpn events only' via email server profile. He's already getting emails for WebUI and CLI events from admins on a 'Config Log Format'.What I have discovered is, he can possibly get sslvpn events from the 'System log Format' if the values for 'subtype' is listed. However, it a...

CVE-2013-2423.

Hi,I see this signature is being disabled. Anyone know why? I dont see a replacement sig.http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2423.CheersDennis

Hi All, I have a question regarding the integration with Aruba Networks Clearpass. We have Clearpass configured according to the instructional PDF. We are seeing some inconsistencies with the mapping of users. As can be seen below.

Spotify not being blocked as a media audio-streaming application

I've created a policy to deny all applications that fall within the media audio-streaming application. When testing the application it doesn't deny access. Monitoring shows that appliance as recognizing it as an SSL application. Is there a way to deny this without having to deny the URL within the URL filtering policy?Regards,Tony Marques

How to See the Apps in a App-Filter via cli or api

Does anyone know how to view what applications match an application filter via the CLI or API. Exactly the same as what you see at the bottom of the application-filter in the GUI.Thanks

Access Scheduled Custom Report

Hi AllI have created a custom report via the GUI. I have scheduled it to run every day for the previous day. I can see in the GUI that there are reports for the last 7 days in the calendar and can view their content. My question is how do I access a report generated on a particular day using the api. At the moment I am using http://192.168.1...

REGEX: Multiple character ranges

Hello,I am trying to make a custom signature using a pattern match that looks for 42 characters 0-9 A-F in the http post field. I tried [0-9A-F]{42} and a few variations but nothing I try works.Is there a way to use this sort of data pattern in PAN?Thanks for any help,-James

API output - threat

Is there an area I can run an API call against that will give me output of the threat signatures? Looking for stuff like ID, severity, name etc.

How to capture User Information for remote access in a "Proxy" Setup

Hi Team, User has a environment that allows user to remote access to their internal resources.However, they are only allowed to remote access to a single common server (Jump Server). After which they will use this Jump Server to remote access other internal resources.User wants to have user visibility on this setup.May I know if PAN can achieve ...

Returning xpath information using panxapi

I'm writing a script to disable a rule using panxapi. I'm trying to check to make sure the rule exists. I've found if I have a typo in the rule name, panxapi will create the rule as a blank, so I need to make sure the rule exists before running panxapi to disable it. I started testing how to do this and have run across something I don't under...