Connection to self.events.data.microsoft.com/OneCollector/1.0/ is flagged as log4j

[Zakuan]

Hi, anybody knows why connection to self.events.data.microsoft.com/OneCollector/1.0/  is being flagged as log4j by Palo Alto firewall? 

Threat: Apache Log4j Remote Code Execution Vulnerability(92004)

Threat ID: 92004

Threat Category: code-execution

I believe this is telemetry from Microsoft products, probably MS Office. Appreciate if anybody can help to explain.

Thank you. 

[laurence64]

Hi 

The Palo will just be recognising a certain pattern of traffic leaving the device to an untrusted network, this traffic obviously matches that and it is flagging, according to Alienvault here https://otx.alienvault.com/indicator/hostname/self.events.data.microsoft.com you are correct and this is a benign site, if this is causing you issues with logging or indeed connectivity, you could bypass that url as a trusted entity.

However I should also say that although it is whitelisted, you should check further to confirm that the hosts the traffic is coming from are expected, not Linux servers for instance, and then only tune it out for those hosts if you are completely sure that is the best thing to do, Alienvault also shows that some malicious files have been seen on that URL and this is fairly normal for telemetry URL's as hacker will always try and get stuff across "trusted" or default connectivity.

As always don't whitelist anything like this unless you are sure, I am not aware of your environment and so would never say to do it on my say so!

[mikalozano]

Thank you so so much. This answer was very very useful to me.

friday night funkin