Custom Signatures

Welcome to the Custom Signatures Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Welcome to the Palo Alto Networks Custom Signature discussion board!

The purpose of this board is to discuss everything related to custom signature creation in PAN-OS devices. Palo Alto Networks delivers a large quantity of coverage in our weekly content updates; however, we know that our customers are staffed by dedicated security professionals as well, and we would like to provide an environment in which to fos...

Custom App-ID with just source and destination ip address

Hi, I have some traffic on a tap interface that I would like to create an APP-ID to identify it in the monitor logs. This a seperate network with its own custom application and functions. I have done some pcap's and can't see distinct data that relate to the context values in the custom App-ID form. Is there a list of what the context values a...

App-ID through SSL Client Hello

Dear All, i have gone through packet capture to create an App-ID for the the bellow traffic : I don't get the respective traffic translated though. Any thoughts why?

intermediate certificates

Hello everyone, Is there a solution other than manually importing intermediate certificates into the Palo Alto Firewall (PAN-OS10.2.9-h1)? Since there are weekly a few websites with this problem popping up. I already know the import procedure that is described in the knowledge base. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail...

Blocking claudebot from scanning sites

Is it possible to create a rule/application (or if there is an existing one) to block certain bots from scanning websites behind the firewall? I see the claude application, but I'm guessing this is more for outbound requests than for blocking the bot. thanks!

Zoom phone custom signature thru: ssl-req-chello-sni

Hi everyone! We are currently moving our phone system to zoom, and we had an issue with the zoom application, some of their traffic its categorized as an incomplete causing that some calls hang out, or don't ring, i downloaded the packet capture log and i saw packets from zoom droping. I made an application, using the signature ssl-req-chell...

Sending NFGW (Palo Alto) firewall logs to Cortex XDR.

I would like to know if it would be possible to send the logs to Cortex XDR, using Cortex XDR PRO PER ENDPOINT licensing? What would be the possible methods? I know it is possible using Cortex Data Lake, but with Pro-GB licensing.

Palo Alto Threat Vault AntiVirus Signatures

Hi Community! I wanted to better understand how Palo Alto ties it's detections with its Unique Threat ID to the Wildfire Virus Detections. For example, we have been receiving a steady amount of alerting for a Virus File and Palo Alto gives us the file name. If I search for the Unique Threat ID, I can see SHA-256's that Palo ties to it. S...

Windows Update Delivery Optimization (WUDO) Custom App-ID

Just seeking a Custom App-ID for Windows Update Delivery Optimization (WUDO).

Can custom appIDs, without signatures, be applied directly to a security policy?

For this discussion, we created custom appID `myApp`, it has NO signature. If `myApp` uses port 22, the port of another known app (SSH), then to use `myApp`, it must be applied to an App Override policy. But what if `myApp` uses unique port 2121, can then `myApp` be applied directly to a security policy or does it still need to be added to a...

We updated the dynamic antivirus database and threats, but it failed

I've been waiting for 3 days to get help ! My introduction is Mr. Dwi From PT. Tabsolutions Indonesia This is my device Device Name : PA-3020-PLN Software Version : 9.1.16 Globalprotect Agent : 5.2.12 Mac Address : 24:0b:0a:00:40:60 Serial Number : 0018010419...

creation of custom app id

Hello everybody, i need to create custom app id in firewall for only gives access to get method while api call, but when i wrote signature i can not define the contex of the method in http request.Any help?

CVE-2023-38802 Dynamic Update Signature

Hi Palo Alto Networks Team, I would like to request to add CVE-2023-38802 vulnerability signature to dynamic update. I have a few of client having concern about this signature.

Regarding for reason and detect contents.

What communications does this rule detect? I want to confirm is correct an answer by user. Answer by user: In order to split the CSV, I created and executed "extract.bat". Detection Rule: ・Behavioral threat detected (rule: powershell_cradles.b) solution: Cortex XDR

Customizing Response pages

Need help in identifying a document with all the variables listed to customize response page. This customization is to inform users, the reason why the URL is blocked

Looking for help with a custom vulnerability signature to detect usage of the RC4 cipher set

I am struggling with getting a custom vulnerability signature to detect RC4 server responses. We have created other custom signatures that are working just fine within the same test policy. For example, checking for TLS 1.0, 1.1 etc.... I have tried a number of different pattern matches against the ssl-rsp-server-hello context without success....

Discussions