Is PA capable to scan for malware in Activesync/Outlook365 traffic?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Is PA capable to scan for malware in Activesync/Outlook365 traffic?

L2 Linker

Hi,

We have PA-850 appliances with Wildfire and AV licenses.

Recently we enabled the decryption of email traffic and now we are dealing with the data protection officer, he is asking us to detail what exactly is being inspected.

At first I thought all attachments and URL were inspected.  But then I found some information about link analysis only happening for SMTP traffic.

https://docs.paloaltonetworks.com/advanced-wildfire/administration/advanced-wildfire-overview/advanc...

For file analysis, I could not find any mention about the application protocol supported. 

https://docs.paloaltonetworks.com/advanced-wildfire/administration/advanced-wildfire-overview/advanc...

We are using Microsoft native protocols (activesync, ms-exchange,office365,...) and mapi-over-http and rpc-over-http. SMTP is not allowed because security reasons.

I assume that files transferred using HTTP are being scanned, but what about if a file is transferred using any other protocol? is Paloalto doing something?

 

thanks

 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Let me caveat this by saving the PAN already must have a detection signature for it. Meaning it will not scan/send attachments to wildfire, etc.

 

Hello,

Yes if the traffic is not encrypted. But also not guaranteed. For email traffic its best to utilize an actual email scanning appliance or service. I would go with an online scanner rather than an onsite appliance for several reasons.

 

Regards,

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

Let me caveat this by saving the PAN already must have a detection signature for it. Meaning it will not scan/send attachments to wildfire, etc.

 

Hello,

Yes if the traffic is not encrypted. But also not guaranteed. For email traffic its best to utilize an actual email scanning appliance or service. I would go with an online scanner rather than an onsite appliance for several reasons.

 

Regards,

Thanks for your reply. I performed tests accessing with outlook client and OWA, both decrypted flows. I can confirm that via HTTP the virus is detected and the connection reset. Via outlook, the virus travels safely until the destination mailbox 😉 so it is consistent with the documentation, PaloAlto does not inspect Activesync or any other MS email protocol.

thanks!

  • 1 accepted solution
  • 1510 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!