Testing Log4J with AWS Cloud NGFW

[mderaet]

Hi,

what is the curl command in AWS EC2 to test if Log4J is well blocked by my AWS Cloud NGFW?

[dtaneja]

Hello @mderaet
 

Greetings from Palo Alto Networks!

I saw your post and here is the curl command please make changes based on your environment IP address. 

Below is the video link which explains CloudNGFW implementation against the Log4j attack.

https://youtu.be/OovXk4WF7vs

Regards,
Devanshu Taneja
Product specialist
Palo Alto Networks
https://live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW
*Don’t forget to accept the solution provided!*

[mderaet]

Hey Taneja,

that would be lovely if I can copy the command as it is not possible. It seems you gave me a picture?

[dtaneja]

Hello @mderaet

Greetings from Palo Alto Networks!

I apologize I was having an issue pasting the command here.

Please find the pdf file attached to this post which contains the curl command and please make changes in the command based on your environment IP address.

Below is the video link which explains CloudNGFW implementation against the Log4j attack.

https://youtu.be/OovXk4WF7vs

Regards,
Devanshu Taneja
Product specialist
Palo Alto Networks
https://live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW
*Don’t forget to accept the solution provided!*

[mderaet]

Hey Taneja,

it does not work

So I would like to open a support case (I have premium support) and have a zoom meeting monday to solve this.

Thanks

[mderaet]

I would like to give you more details on this but impossible with the chat box here.

[mderaet]

Hi

I launched this curl to an external web server (a colleague of mine) and the curl is successfull!!

In cloudwatch I can see the rule which allows this curl..  Isnt Log4J attack blocked by default?

Please advise

[dtaneja · Accepted solution]

Hello @mderaet

Greetings from Palo Alto Networks!

Log4j attack is blocked by default in CloudNGFW please make sure your CloudNGFW security profiles are set to Enabled (Best Practice).

Please refer to the below link for your reference.

https://docs.paloaltonetworks.com/cloud-ngfw/aws/cloud-ngfw-on-aws/rules-and-rulestacks/security-pro...

Regards,
Devanshu Taneja
Product specialist
Palo Alto Networks
https://live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW
*Don’t forget to accept the solution provided!*