General Topics

Discover LIVEcommunity Through Our New Animated Explainer Video!

We’re thrilled to unveil a brand-new animated video that highlights everything LIVEcommunity has to offer! This short and engaging video gives you a quick tour of the many resources available in our vibrant community — from interactive discussions and customer journey guides to the Cyber Elite program and Member Spotlight features. Whether ...

Syslog miner fields

Looking for some information on the fields to use for the syslog miners... This document explains the fields and lables but it doesn't appear that minemeld follows it exactly from other examples I have seen, here and here. I am trying to pick indicators from a certain direction, sourced from a certain zone, and according to the log descripti...

Panorama

With Panorama, how oes know when or fi they need to upgrade it? What are symptoms of box that needs upgraded from M-100 to M-500? Is there s trending log that shows histortical? I hav a M-100 which supports 4 pairs of 5060 2 pairs of 3020 and 3 pairs of 7050's/

Resolved! Changing max logging rate to 50000 on VM-100

I followed the learning article What Units are used for Max-packet-rate and Max-log-rate?on a PA VM-100:admin@PA-VM> show system info ... vm-license: VM-100 vm-mode: VMWare ESXi sw-version: 8.0.3 ...And the max logging rate modification does not seem to work: admin@PA-VM> show running logging Max. logging rate: 1280 cnt/s Max. packet loggi...

Cannot retrieve contents of MineMeld Output Processor

Guys, I'm new to Minemeld (AutoFocus version). I've setup my first Output node. Very simple, just using the prototype that tracks Azure IPs. I'm going to use it in a Palo rule to allow specific traffic outbound to Azure IPs. Below is the scenario: -When I CLI into the firewall and test retrieving the list, it gives me the generic message "HTTP...

Resolved! Minemeld miners timing out, but curl works fine.

Hi, I am having problems running miners in my network. We use a proxy, so that might be an issue, but the HTTP_PROXY and HTTPS_PROXY values are set correctly, and curl/wget work fine. But I am unsure how to check what Minemeld is doing. This is what I find in the error log when trying to manually trigger "IPNode4" to retrieve its indicators:...

Resolved! SPAN port on Dell N2048P

Hi Got a PA-850, wanted to install a TAP port into the DELL N2048P, but it doesn't have capability to do a SPAN port. Any suggestions on how to deal with that. I do have the PA as DGW for all the networks, more worried about looking at PC to PC - same vlan

Log Collections - I am confused

Hi Okay I have pa-5220 - cluster and a single pa-850 and 1 panoram vm. I would like to see all the log that i see by logging into the individual fw on the panorama interface. So do I need to setup panorama as a log collector or do I setup log forwarding on the devices to point to panorama. I'm currently try thishttps://www.paloaltonetworks.com/d...

Move Rules to Device Group Order

Hey i just noticed that on panroama 8.0.2 when you move multiple rules to other Device group than the rules are moved in other order than the original order.for example if you select the last rule and than select the first rule and move than to other device group they will apear in the reverse order

Resolved! Capacity - want to see last 7 days

I want to be able to see what the CPU usage of the firewall has been for the last 7 days or so. I can only find the current usage on the dashboard. Is there a report that will show me what the capacity on my firewall has been for 7 days or more?

Resolved! a problem with json output

Hello, I have a problem with json output. I have configured output node with "value":true configured but I still cant get indicator value in json format. I try to get data in this way -> https://xxx.xxx.xxx.xxx/feeds/node-1498136004722?v=json But value field in reply is empty: 0 indicator "xxx.xxx.xxx.xxx" value 1...

Resolved! How to verify a specific Threat is blocked?

Hi Folks, I am being asked how we know that specific threats like Wanna Cry and Petya are blocked by our PA 3020. I see that our Content was updated back in 698 release that includes the update for Microsoft SMB vunerability, threat ID 32422 and has a CVE number. We are up to date... I've been searching the threat log based on CVE number, but s...

Resolved! Malware everywhere

Hello there,I'm planning in getting some Palo Alto equipment/ services as I'm an average Jenny but I keep getting tampered by vicious trolls/hackers.I have multipath internet connections and several malware on my laptop. Even when I take it to the store for restore it doesn't go away! I read might b a rootkit! I have python commands, ssl in an o...

Can't access dropbox website .PAN does SSL inspection

Traffic traverse as below PC(attempting to access dropbox website >Web proxy that does ssl inspection>palo alto firewall that does ssl inspection and forward drop box traffic to>web proxy that does ssl inspection> drop box website. Symptom: I get dropbox home page but it just hangs at home page and I can't go any further Dropbox ac...

Customizing Parameters for Alienvault

Hello, I am new to MineMeld and was trying to figure out how to customiz the alienvault reputation prototype to only pull in values with a alienvault_reliability > 5. I have the feed setup to an stdlib.aggregatorIPv4Generic and then to a FeedHCwithValue that I customized to drop anything with an alienvault_reliability < 5. However it do...

DHCP trough the PA

Hi all, I'm having a question about allowing DHCP trough the PA firewall.The issue I have is the following. - We have a PA deployed between LAN, Internet and WAN- The LAN has a L3 switch, that performes inter VLAN routing, and uses a transit subnet and a default route to the PA- DHCP relay is configured on the L3 switch, pointing to the DHCP ser...

Discussions

Discover LIVEcommunity Through Our New Animated Explainer Video!

Syslog miner fields

Panorama

Resolved! Changing max logging rate to 50000 on VM-100

Cannot retrieve contents of MineMeld Output Processor