- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
How do I work with memory dumps in Traps?
- LIVEcommunity
- Collaboration
- Discussions
- Endpoint (Traps) Discussions
- How do I work with memory dumps in Traps?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
How do I work with memory dumps in Traps?
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report This Content
06-06-2018 02:32 PM
I've created a task to perform a full memory dump on a specific machine. The task results in a massive list of "dump" files in .zip format spread across several minutes. I have no idea what to do with these files or how to glean information from them. I would love to see a video of someone performing analysis on an event using a memory dump that was manually requested.
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report This Content
06-07-2018 05:59 AM
The dumps that are gathered from a prevention event include files in use during the time of the prevention, and a memory snapshot (.dmp). The dmp file can be viewed with programs such as windbg. Palo Alto Traps support has been trained on how to review and analyze these dumps, and can review any dump you submit to them. You can always open a case through the Palo Alto support portal, and submit the dump for review. Should they find the prevention to be a false positive, they can offer a solution for you.
- Do Palo Alto plan to add endpoint DLP option to the Cortex XDR/Traps offering? in Cortex XDR Discussions
- Feature Request – Add ability to capture memory dump in Cortex XDR Discussions
- Scripts/ Download File size limit in Cortex XDR Discussions
- Skype for Business and Traps 6.0.1 in Endpoint (Traps) Discussions
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
