General Topics

Reliable Threat Feed with lowest false positive for Production Environment

I am wondering, which threat feed is most reliable with lowest false positive that can be used in production environment. Does anyone have done analysis on it? Which one is most commonly threat feed used by customer in production environment? Does anyone using confidence level for any feeds? Thanks,

Error reading last checkpoint

Hi everyone, I am facing an issue that floods my output SIEM a little to often. The issue seems to be that the miner node is unable to register where it left of during the last check. Any tips on solving this? 2016-11-14T08:54:30 (17269)base.read_checkpoint ERROR: sslabusech_dyreblacklist - Error reading last checkpoint Traceback (most recent ca...

Oracle Web Cache/Proxy fails when behind Palo Alto Firewall

I have a situation where by when an Oracle Web Cache server is placed behind a PA firewall, the application takes time to load or fails in some cases. The design is as followins;Windows 7 Client --> Routers --> PaloAlto Firewall --> Radware Loadbalancer port 80 (VIP) --> Oracle WebCache Server port 7777 --> Backend Oracle Apps....

Resolved! Check error on interface

Hi, I was playing around with CLI and typed the command:>show system state filter sys.s1.* | match crc Then got this details:sys.s1.p5.detail: { 'bad_crc': 0x157352, 'fragments_pkts': 0x1247, 'mac_rcv_error': 0x228b09, 'pkts1024tomax_octets': 0x13e0fad85, 'pkts128to255_octets': 0x237e24c6, 'pkts256to511_octets': 0x31eb1cec, 'pkts512to1023_oct...

MineMeld Docker

I started building out a very simple dev (read: unhardened) docker build for MineMeld here: https://github.com/swannysec/MineMeldDocker Looks like it won't start up correctly inside a container and I think it might be related to the use of UNIX sockets and/or something to do with supervisor. Anyway, feel free to take a stab at it! I have to ...

rsyslogd dependencies problem

Hi Luigi, I was testing stdlib.localSyslog to correlate paloalto logs with indicator following this article https://live.paloaltonetworks.com/t5/tkb/articleprintpage/tkb-id/MineMeldArticles/article-id/11 But I was unable to make it work. After a while, I have noticed that rsyslogd was not running. If you run "service rsyalogd status" says th...

Link types for HA

I have a client who wants to split their PA3020 HA cluster between 2 datacenters. What are the limitations for the HA1/HA2 interfaces in terms of distance, and network latency for active/passive HA to work cleanly. On a 3020 can HA1/HA2 functionality be forced through an in-band interface? (not desireable,) The customer prefers a single route...

BGP Multiple ISP VR Requirements

I'm attempting to wrap my head around a very critical piece of setting up BGP between 2 ISP's concerning how many Virtual Routers are required. I currently have 1 ISP (A) up and running on BGP just fine and my other ISP (B) will be converted to BGP on Monday. Both will be advertising my public IP space from ARIN. So my question is, do I put bot...

Application Filter Traffic Reports

Is it possible to view traffic related to a specific application filter through the "Monitor" tab? For example, if I setup an application filter for the "gaming" subcategory, can I view the related traffic without specifying each application individually or generating a custom report? I'm running Panorama 7.1.5 and I'm not seeing an option to fi...

Port scan and sweep scan

Hi,How to block PortscanningOr atleast logThanks

Resolved! Best Practice policy 7.1

I am attempting to implement best practice internet gateway in the 7.1 admin guide. One on the steps toward the end is creating Temporary tuning rules to see what applications are communicating over non-standard ports. I have rule above the tuning rules allowing for web-browsing and ssl over "application-default" I was surprised on the amount of...

active/active vpn query.

Hi Team,Case no: 00567829I have a customer, who have active/active set up.He had configured a vpn with the floating ip.The vpn is working fine. No issues with that but he is getting system alert message on the active/secondary device about the phase1 negotiation. I can see that the vpn up on the active/primary device and on the secondary device ...

Resolved! Save Credentials Global Protect

Hey Guys, I'm running the latest software with 7.1.5 and Global Protect 3.1.1, and I'm missing the feature to save the credentials. In the agent settings I configured the Save User Credentials to Yes, but neither the username nor the password is really saved. Also I tried to add the registry key for the option to save the credentials on the clie...

Resolved! Why the chart not continuous?

Dear all, My customer have issue when checking report. Boss ask him why the chart not continuous? Who can help me explain at the red circle? Why and when it will continuous or not. So many thanks and hope get reply soon.

Investigation of possible threats

My company has a PA3050. I am new to this device. It is currently setup to mirror/monitor port on current Cisco firewall. The device is reporting that it is finding suspicous files and various other vulnerabilities. There is concern that this is showing that there is active hacker activity on the network. Is there a way to tell the differen...

Discussions

Reliable Threat Feed with lowest false positive for Production Environment

Error reading last checkpoint