06-20-2017 01:45 AM
Running PAN-OS 6.1.15 and content 709, when I filter for "spam-urls" (a category that I wasn't really aware of previously), Panorama returns "extremism" hits. Am I missing a trick here or is something broken?
06-20-2017 07:28 AM
Hi, we're using the PAN-DB; "extremism" was a new category in that last August.
06-20-2017 09:43 AM
Hi @notes01
I just installed the 6.1.15 in my lab, with content 708 and the reason you are seeing the category spam-urls, is because you are using BrightCloud URL filrtering and not PAN-DB. Spam-urls is a category that only exist in BrightCloud.
Because you are using Panorama, I would recommend that you confirm if you are using the same URL filtering subscriptions (Enabled) on both ends because the spam-urls category belongs to BrightCloud, and Extremism is only present in the PAN-DB, which as you mentioned was included last August as part of the content update 602.
BrightCloud SPAM-URLs Category
As I am sure you are aware, there's have been issues with content 709, and it has been pulled out of the dynamic update website. The current recommendation is to stay with whatever content update you were running before the release of 709.
Let me know how it goes.
Willian
06-30-2017 06:47 AM
Thanks for the pointer - we used to use BrightCloud but switched to PAN-DB a couple of years ago. I've checked through Panorama and the firewalls and everything is correct.
The first sight I had of the category was in a daily report that Panorama generates; at first I didn't think much about it but later, piqued by this, I then tried it as a log filter. Even though we often get hits on "extremism", I'd never seen that category in the report and clearly it's coming up with "spam-urls" instead.
It would be interesting to see if the behaviour can be replicated. It's not security-shattering stuff though, low priority in my book.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
