spam-urls ?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

spam-urls ?

L2 Linker

Running PAN-OS 6.1.15 and content 709, when I filter for "spam-urls" (a category that I wasn't really aware of previously), Panorama returns "extremism" hits. Am I missing a trick here or is something broken?

4 REPLIES 4

Hi @notes01

 

Are you using the BrightCloud URL filtering subscription or PAN-DB?

Hi, we're using the PAN-DB; "extremism" was a new category in that last August.

Hi @notes01

 

I just installed the 6.1.15 in my lab, with content 708 and the reason you are seeing the category spam-urls, is because you are using BrightCloud URL filrtering and not PAN-DB. Spam-urls is a category that only exist in BrightCloud.

 

Because you are using Panorama, I would recommend that you confirm if you are using the same URL filtering subscriptions (Enabled) on both ends because the spam-urls category belongs to BrightCloud, and Extremism is only present in the PAN-DB, which as you mentioned was included last August as part of the content update 602.

 

BrightCloud SPAM-URLs Category

Bright-Cloud-URL-SPAM.PNG

 

 

As I am sure you are aware, there's have been issues with content 709, and it has been pulled out of the dynamic update website. The current recommendation is to stay with whatever content update you were running before the release of 709.

 

https://live.paloaltonetworks.com/t5/Customer-Advisories/UPDATED-06-19-Important-information-regardi...

 

Let me know how it goes.

 

Willian

Thanks for the pointer - we used to use BrightCloud but switched to PAN-DB a couple of years ago. I've checked through Panorama and the firewalls and everything is correct.

 

The first sight I had of the category was in a daily report that Panorama generates; at first I didn't think much about it but later, piqued by this, I then tried it as a log filter. Even though we often get hits on "extremism", I'd never seen that category in the report and clearly it's coming up with "spam-urls" instead.

 

It would be interesting to see if the behaviour can be replicated. It's not security-shattering stuff though, low priority in my book.

  • 6903 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!