Host sweep alert from an iPad

We have an iPad that is triggering our scan block policy as a host sweep. The iPad is attempting to connect to one external (Internet) IP over port 443. It's happened for the past few days to a different external IP each time.

Threat vault info.

Name:

Virus/Win32.WGeneric.ajtozf / ms-ds-smbv3

We have been seeing alot of detections for smbv3 for file detections varying from pdf to any office document. Wildfire has been picking up the traffic, marking it as Threat and either resetting it or alerting on in. This monthly only we have had abou

Syslog to exclude BYOD subnets from logging

Hi all , We do have a few questions on Logging. 

1. Can we exclude the BYOD subnet from alerting as they flooding us with irrelevant logs. (both URL and Threat monitoring)

2. Can we exclude some category in URL from sending syslog messages. Example he

ssl forward decryption not work with URL category (proxy-avoidance-and-anonymizers )PAN 10.0.5

I upgrade from Pan os  9.1 to 10.0.5 and i foud some issue in any proxy website with URL category (proxy-avoidance-and-anonymizers ) like https://www.proxysite.com/  it  bypass any blocked traffic even with ssl decryption policy ,however other catego

pa3220 POS 9.1.5

howdy,

The short question is a block country rule on 1/8 the thing to do?

or  a white list of ip? and apps?

Thank you

Mike

2960X - WAN and DMZ on same switch separated by vlans?

the title says it pretty much. Trying to consolidate a 24 port switch that only uses 3 ports with another 24 port that is only using 2 ports.

How safe/comfortable would you be if you used the same switch for DMZ and WAN traffic, but separate them b

DNS Tunneling

Im trrying to detect dns tunneling with custom signatures.

i have some snort rules to begin.

some of you have any strategies for this?

Virus/Win32.WGeneric.aeulpb (297499053)

Hi Community,

We are seeing this signature in our environment for ms-ds-smbv3 application. PAN is marking the internal traffic as 'virus' before resetting it on both ends.

Any suggestions what would be the investigation process for it. What are we lo

Microsoft Directory Services/ms-ds-smbv3 - /Virus/Win32.WGeneric.badouv

Hello,

We are seeing so many alerts in the threat logs that are linked to:

Virus/Win32.WGeneric.badouv

Name: Virus/Win32.WGeneric.badouv

Unique Threat ID: 398700357

Create Time: 2021-02-03 13:41:24 (UTC)

Threat ID: 1103259

Current Release: 3615 (2021-02-03