Unknown File Types

[Hithead]

Hi all,

we like to block or be alert when the file types .edrw and .easm (eDrawing) are passing the PA. Currently nothing is shown in the Monitoring Data Filtering.

Any idea how to get PAN to update file types in security profiles? Can I somehow report it to PAN?

[reaper]

Hi

to have these filetypes added to the file blocking known filetypes you can reach out to your Palo Alto Networks SE to have them added in a feature request for our engineering and product management team to consider.

In the meanwhile you could go ahead and build a custom signature to match attributes common to these types of files (like any strings that would appear in the file) and have them blocked by means of threat prevention

this doc should be helpful: Creating Custom Threat Signatures

regards

Tom

[Hithead]

Hi,

this means, if we are transfer 'PA unknown' file types, we will never be able to log and recognize it?...sad.

[SDorsey]

You can log and recognize it if you create a custom threat signature.

I don't believe the PA identifies files solely based on the file extension.

[Hithead]

I have so many policies, zones etc. For example the internet  has so many of custom signatures. So how I have to detect them?

Also I like to see all data traffic in the Data Filtering Monitoring tab...

BTW: Could someone help me to create the custom signature for the both file types written in the first post?

[Hithead]

Hi,

created a custom signature, but I cannot define client2server or server2client. I like to block only uploads but PA is blocking both... could you please take a look?

both (NOT one of them) pattern of this file type should match:

Our profile (add the custom object as exception):

Thx in advance!