Minemeld: Custom IP list, miner etc for EDL.

I apologize if this has been answered in previous posts, I've tried searching and it seems that I'm getting bit and pieces but not the whole picture.  

How would I go about creating my own list of IPs and then customizing Minemeld to mine \ gather

Understanding Panorama Log Ingenstion & Sizing

I am new to PA & I'm trying to understand the necessity of log collection to a Panorama VM.  My company is about to deploy PA-3220's in HA pairs in several data centers.  We have a single Panorama VM getting deployed for 6 firewalls (3 HA clusters). 

QOS for multiple user addresses

Hi

i need to create a qos policy to limit downloads and uploads of user addresses objects created on palo alto device

i know that i will ceate a qos profile for down and up  , choose a class , priority and type guaranteed and max BW

then create a qos

Panorama PAN-OS 8.0.8 and always highlighted (Green) Commit button

I have recently upgraded Panorama from 7.1.x to 8.0.8. Although there are no changes and all firewalls are "in sync" for the configuration, the Panorama "Commit" button is Green/Highlighted. Is there anyone using Panorama with 8.0.x and seeing the sa

Palo Alto firewall generates SSL version / cipher suites errors

Hi, i have a very strange issue. I have a webserver protected by a palo alto NGFW, if i disable inbound ssl inspection policies everything works fine and i can access the server as intended. 

However when i enable the inbound ssl inspection policy, w

USER-ID - Windows Server 2016 - Event Log Viever permission issue

I cannot read AD logs on Windows Server 2016 with the event viewer read group access. Is there anything special that needs to be on Windows 2016 Domain?

Thanks

Dynamic Update from Panorama doesn't work

I want to use Panorama to perform dynamic updates for the "Antivirus" and "Applications and Threat" sections.

On remote firewalls, I configured Panorama as the update server.
I also scheduled the automatic update via a template.

In Panorama, I have the

DNS Format That sent to Arcsight it contain www?

Malicious domain names some of them contain www before domain name like www.xyz.com.

so if there is any solution to define that as domain name only like (xyz.com) to use it in correlation rules.

Why is this traffic allowed when the rule should not allow it?

I am tidying up some rules that were "rush" jobs as part of the initial deployment.

One rule "TEST-VI" was 

SRC ZONE - TRUST  
DST ZONE - Partners
DST Addr - I%%%%%A-VIP

Application - Any

I was going to get rid of this as there is another rule after it