Connection to self.events.data.microsoft.com/OneCollector/1.0/ is flagged as log4j

cancel
Showing results for 
Search instead for 
Did you mean: 

Connection to self.events.data.microsoft.com/OneCollector/1.0/ is flagged as log4j

L0 Member

Hi, anybody knows why connection to self.events.data.microsoft.com/OneCollector/1.0/  is being flagged as log4j by Palo Alto firewall? 

 

Threat: Apache Log4j Remote Code Execution Vulnerability(92004)

Threat ID: 92004

Threat Category: code-execution

 

I believe this is telemetry from Microsoft products, probably MS Office. Appreciate if anybody can help to explain.

 

Thank you. 

 

2 REPLIES 2

L3 Networker

Hi 

 

The Palo will just be recognising a certain pattern of traffic leaving the device to an untrusted network, this traffic obviously matches that and it is flagging, according to Alienvault here https://otx.alienvault.com/indicator/hostname/self.events.data.microsoft.com you are correct and this is a benign site, if this is causing you issues with logging or indeed connectivity, you could bypass that url as a trusted entity.

However I should also say that although it is whitelisted, you should check further to confirm that the hosts the traffic is coming from are expected, not Linux servers for instance, and then only tune it out for those hosts if you are completely sure that is the best thing to do, Alienvault also shows that some malicious files have been seen on that URL and this is fairly normal for telemetry URL's as hacker will always try and get stuff across "trusted" or default connectivity.

As always don't whitelist anything like this unless you are sure, I am not aware of your environment and so would never say to do it on my say so!

PCCSA PCNSA PCNSE PCSAE

L0 Member

Thank you so so much. This answer was very very useful to me.

friday night funkin

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!