About HITSSEC

HITSSEC · ‎06-15-2015

None here in the last week. 1 M incoming url requests per day. Phil

HITSSEC · ‎06-11-2015

True. but having an Antivirus Profile of "none" will not work for testing. That was the main point I was suggesting. The block profile is just what we have in place.

HITSSEC · ‎06-10-2015

Slawek, Your screen print for the sample rule should have an Antivirus profile that blocks traffic. Like below: Profile view: Just saw it was missing in your example and may have been an oversight on your part. Hopefully this helps. Phil

HITSSEC · ‎06-08-2015

Steve, We generally wait for the tester to cry "Uncle" as our IPS has a block IP response action for many of the threat signatures. If they are paying attention, they will notice a lack of responses and get in touch with their contact. If they just run the script then the will have very little to report on. If they are professional they will report on their success with the IPS enabled and also report on the vulnerabilities on the underlying server (without IPS protection). That way you get two useful reports. Phil

HITSSEC · ‎06-08-2015

Rich, Yes if you trust your tester, otherwise limit the rule to the apps and/or ports in the original rule. Phil

HITSSEC · ‎06-08-2015

We started with the standard policies / vulnerability profiles to see how effective the current state is. If your IPS is set to deliver a Block-IP response they the test may be a short one. We then created a rule above the standard rule that handles the traffic to white list the tester with a profile that was alert only. This way you get to see how effective your policies are and the tester gets to test the underlying servers to see how effectively you have them patched and configured. Regards, Phil

HITSSEC · ‎05-19-2015

Just to add a bit of detail to Steve's Answer: System logs under the monitor tab. filter: ( description contains 'Captive Portal authentication succeeded for user: domain\user') Hope this helps. Phil

HITSSEC · ‎05-13-2015

Asntonic We have written signatures for malicious intended web requests and to block the downloading of specific files (adware, toolbars, undesired software). Phil

HITSSEC · ‎05-12-2015

Thanks for the update Santonic as I could see nothing wrong and was about to say "time for the wireshark packet capture to see what the available data looks like". Good luck with your signatures. I have written a lot over the past 2 years and they have proven to be useful. Phil

HITSSEC · ‎05-07-2015

Hello we started seeing Google using the quic application to download Gmail attachments to the client's desktop. This application was not decrypted using a forward proxy and thus did not give us visibility for file attachments being downloaded within GMail. Does create a blind spot and thus pose a risk. Will try blocking it to see the impact is. Phil

HITSSEC · ‎05-06-2015

ajr13, The web site could have been hosting malware (thus being categorized as malware). If the site administrator was informed and then removed the malware and patched their server to prevent further malware being placed on the server. The site then get a re-categorization request and since the malware is not there anymore it gets classified as it normally should be. This is how I expect it works. Hope this helps. Phil

HITSSEC · ‎04-19-2015

Hello Sly_Cooper, Since most people set up a fictious IP address as their sinkhole IP address, there is no host on the other end. Any tcp traffic would not make it past the initial syn requests. In order to capture some traffic, the destination host would have to be listening on the applicable port and get past the three way handshake. The data folowing that would be what you are looking for. A sinkhole is just a destination for traffic to go to, it's main benefit is identify infected hosts based on seeing the traffic attempts to the destination IP address of the sinkhole. Hope this helps, Phil

HITSSEC · ‎04-15-2015

Hello, We have created a custom vulnerability signature to detect XP devices based on identifying the user agent string as described in Custom vulnerability signature for identifying Windows XP clients . The issue we are encountering is that the signature by default has an action of alert but in the vulnerability profile there is an exception response of reset-client. The issue we encountering is that the signature action is inconsistant. We are seeing threat log entries with the action of alert as opposed to the anticipated action of reset-client. Any ideas what might be causing this behavior? Any ideas or thoughts would be appreciated. Phil

HITSSEC · ‎03-25-2015

Daniel, From what I can see you could turn the URL continue timeout from the default of 15 minutes down to 1 minute. The intention is to apply the setting at the category level so that presents a challenge for what you are doing. If the click to continue is worded properly then the user is acknowledging that accessing sites that fall into that category may be non work related or inappropriate. The other option is to set up a Custom URL category with a click to continue and populate it with the specific sites. (not sure if this would fit your situation) Hope this helps? Phil

HITSSEC · ‎02-11-2015

Sven, If IPV6 is enabled, try disabling it. This fixed a lot of our issues with Global Protect on start up. Phil

Member Since	‎02-17-2011 02:48 PM
Date Last Visited	‎01-23-2019 05:58 PM
Posts	141
Total Likes Received	52

Online Status	Offline
Date Last Visited	‎01-23-2019 05:58 PM

About HITSSEC

Re: Drive Mapping with Global protect

Re: GlobalProtect Prelogon without initial Internet Connectivity

Re: Submit a New Threat

Re: How to make custom signature with segment field?

Re: Welcome to the Palo Alto Networks Custom Signature discussion board!

Re: Block External to internal when not using FQDN

Re: Block External to internal when not using FQDN

Re: Honey pot signature

Re: Custom Vulnerability Signature. Is this limitation correct or is a fail?

Re: Custom Vulnerability Signature. Is this limitation correct or is a fail?

Re: Allowing Skype through the PA

Re: Block External to internal when not using FQDN

Re: Welcome to the Palo Alto Networks Custom Signature discussion board!

Re: Block External to internal when not using FQDN

Re: Honey pot signature

Detecting an SSLv2 Server Response with a Custom Signature

Re: Create test syslog

Re: Block External to internal when not using FQDN

Re: Panorama for logging/reporting ONLY

Create a Palo Alto to Sonicwall VPN

Re: Anyone else getting a lot of hits for "ASP Webshell Access" 37482

Re: Threat prevention

Re: Threat prevention

Re: Vulnerability assessment question

Re: Vulnerability assessment question

Re: Vulnerability assessment question

Re: Captive Portal logs

Re: Logical conditions in custom IPS signatures

Re: Logical conditions in custom IPS signatures

Re: Google QUIC traffic blocked?

Re: URL categorization reasoning?

Re: Packet capture for specific ip like signature match

Why is XP Detection Signature not consistantly tripping?

Re: URL filtering issue, choosing to continue onto a blocked site allows all sites that falls into the same category.

Re: GlobalProtect Client - connection establishment speed

Unlock your full community experience!

About HITSSEC