URL Filtering - Dynamic Updates

[roma]

Hello,

We have URL filtering with the PAN-DB license. If a URL is determined to be malicious, (from other URL checking websites, but not from Palo Aloto's yet, since they only categorized it as high risk and unknown at the moment). What is the best way to make sure users will be blocked from it? We are blocking the categories of hacking, malware, phishing and C&C.

Do I add it to my URL filtering block list on the Palo Alto firewall?

I submitted the URL to the Palo Alto website to test it and I requested a change for it to be categorized as phishing, but I received an email back that I would be notified in 24 hrs.

What is the best way to make sure users will not reach a site that is malicious but PA Networks hasnt classified it as that yet?

Thanks,

[OtakarKlier]

Hello,

There are several options including but not limited to:

Block High Risk and Unknown categories (this is best practice)

Block the specific URL

https://docs.paloaltonetworks.com/best-practices/9-0/internet-gateway-best-practices/best-practice-i...

Regards,

[roma]

Thank you, when a URL is submitted to Palo Alto for reclassification - how long does it usually take for them to take action on that?

[OtakarKlier · Accepted solution]

Hello,

I've had it done in less than an hour a few times and sometimes days. It depends on how busy they are on the backend. Humans review the submissions, if I remember correctly.

Regards,