Is PA capable to scan for malware in Activesync/Outlook365 traffic?

[JoseCortijo]

Hi,

We have PA-850 appliances with Wildfire and AV licenses.

Recently we enabled the decryption of email traffic and now we are dealing with the data protection officer, he is asking us to detail what exactly is being inspected.

At first I thought all attachments and URL were inspected.  But then I found some information about link analysis only happening for SMTP traffic.

https://docs.paloaltonetworks.com/advanced-wildfire/administration/advanced-wildfire-overview/advanc...

For file analysis, I could not find any mention about the application protocol supported. 

https://docs.paloaltonetworks.com/advanced-wildfire/administration/advanced-wildfire-overview/advanc...

We are using Microsoft native protocols (activesync, ms-exchange,office365,...) and mapi-over-http and rpc-over-http. SMTP is not allowed because security reasons.

I assume that files transferred using HTTP are being scanned, but what about if a file is transferred using any other protocol? is Paloalto doing something?

thanks

[OtakarKlier · Accepted solution]

Let me caveat this by saving the PAN already must have a detection signature for it. Meaning it will not scan/send attachments to wildfire, etc.

Hello,

Yes if the traffic is not encrypted. But also not guaranteed. For email traffic its best to utilize an actual email scanning appliance or service. I would go with an online scanner rather than an onsite appliance for several reasons.

Regards,

[JoseCortijo]

Thanks for your reply. I performed tests accessing with outlook client and OWA, both decrypted flows. I can confirm that via HTTP the virus is detected and the connection reset. Via outlook, the virus travels safely until the destination mailbox 😉 so it is consistent with the documentation, PaloAlto does not inspect Activesync or any other MS email protocol.

thanks!