Hi, anybody knows why connection to self.events.data.microsoft.com/OneCollector/1.0/ is being flagged as log4j by Palo Alto firewall?
Threat: Apache Log4j Remote Code Execution Vulnerability(92004)
Threat ID: 92004
Threat Category: code-execution
I believe this is telemetry from Microsoft products, probably MS Office. Appreciate if anybody can help to explain.
The Palo will just be recognising a certain pattern of traffic leaving the device to an untrusted network, this traffic obviously matches that and it is flagging, according to Alienvault here https://otx.alienvault.com/indicator/hostname/self.events.data.microsoft.com you are correct and this is a benign site, if this is causing you issues with logging or indeed connectivity, you could bypass that url as a trusted entity.
However I should also say that although it is whitelisted, you should check further to confirm that the hosts the traffic is coming from are expected, not Linux servers for instance, and then only tune it out for those hosts if you are completely sure that is the best thing to do, Alienvault also shows that some malicious files have been seen on that URL and this is fairly normal for telemetry URL's as hacker will always try and get stuff across "trusted" or default connectivity.
As always don't whitelist anything like this unless you are sure, I am not aware of your environment and so would never say to do it on my say so!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!