About kiwi

Palo Alto Networks announces an upcoming general availability of the new Cortex XDR Managed Threat Hunting, an around-the-clock threat hunting service powered by our internationally recognized Unit 42 threat research team. Find answers on LIVEcommunity.     Cortex XDR Managed Threat Hunting Expected in Early June   Security teams rarely have the time and/or the luxury to view and respond to threats, let alone to proactively hunt them. Often these teams are too preoccupied managing alerts, policies and everything else. It's no secret that there's a cybersecurity skills shortage and even the most developed and skilled security teams are experiencing that traditional methods just aren't doing the trick, and they need help in handling the sheer volume of threats and attacks that keep on evolving.   We’re happy to tell you that the help you need has arrived.   Palo Alto Networks is proud to announce the upcoming general availability of Cortex XDR Managed Threat Hunting, an around-the-clock threat hunting service powered by our internationally recognized Unit 42 threat research team.   Made available in February as a limited-time offering, the service has proven its value by identifying real-world attacks for our customers and revealing adversary tactics in third-party testing. In the recent MITRE ATT&CK APT29 evaluation, we surpassed other vendors by scoring a 90% attack coverage.   With Cortex XDR, Palo Alto Networks has created extended detection and response platform. Now, powered by the Palo Alto Networks Unit 42 threat research team the power of Cortex XDR is augmented with a Managed Threat Hunting service, creating the most advanced threat hunting service available today.     How Unit 42 analysts unmask attacks What does Cortex XDR Managed Threat Hunting Deliver? Backed by Unit42: Unit 42 threat hunters leverage emerging threat research to stay ahead of the curve while using the Cortex XDR platform for industry-leading analytics and data exploration. Hunting across endpoint, network and cloud: Leveraging the best minds and machine learning models to detect attacks and improve your security posture. Precise, actionable, and informative reporting.   Cortex XDR Managed Threat Hunting is expected to be available for all customers in early June.      Want to learn more about threat hunting? Join the “Inside the Hunt“ summit on Tuesday, June 23 where experts from around the world will gather and share best practices on security strategies. Learn about the latest techniques and tools to hunt down the most advanced threats. World-renowned experts from Unit 42 will also discuss identifying never-before-seen threats, verify attacks, and reverse-engineer malware for the Cortex XDR Managed Threat Hunting service.   Register for the “Inside the Hunt” summit happening on Tuesday, June 23! https://start.paloaltonetworks.com/inside-the-hunt-virtual-summit   For more details, Zeynep Inanoglu Ozdemir provides an in-depth look in her blog.     Thanks for taking time to read the blog. If you enjoyed this, please hit the Like (thumbs up) button, don't forget to subscribe to the LIVEcommunity Blog.   Stay Secure, Kiwi out!     ... View more

Palo Alto Networks dives into the details of pre-logon mode in GlobalProtect. See GlobalProtect harnesses the combination of user-logon, on-demand, and pre-logon to help secure your endusers from security threats. Find answers on LIVEcommunity.       What exactly is this pre-logon mode in GlobalProtect?   Setting up GlobalProtect can be a daunting task, especially, with all the possible modes available to you. We already discussed user-logon  and on-demand mode. However, all good things come in threes, and the third variant to set up GlobalProtect is pre-logon mode.   The GlobalProtect pre-logon connect method enables GlobalProtect to authenticate the agent and establish the VPN tunnel to the GlobalProtect gateway before a user logs on to a machine. This allows for internal resources to be connected or scripts executed even before a user logs in.   This means that prior to the user login there is no username associated with the traffic. In order to enable the client system to access resources, you must create security policies that match the pre-logon user. These policies should only allow access to basic services required to start up the system, such as DHCP, DNS, Active Directory (for example, to change an expired password), antivirus, and/or operating system update services.    GlobalProtect Security Policy Rule - User Tab for Pre-logon   Once the user logs on to the machine, the tunnel gets renamed for Windows users from the pre-logon user to the actual user who logged in. In the case of Mac users, the tunnel is re-established with the actual user who logged in.   Now, since this deals with two users (pre-logon and actual user), you'll need to configure separate client configs in your portal. One for the pre-logon user and another for any specific user group, which makes this specific setup a bit more engaging than the other two connection modes.    Two views of GlobalProtect Config windows Authentication tab for pre logon and actual user   For step-by-step instructions and to learn all about setting up your GlobalProtect configuration with pre-logon, please review the following Knowledge Base article: Basic GlobalProtect Configuration with Pre-Logon     Thanks for taking time to read the blog. If you enjoyed this, please hit the Like (thumbs up) button, don't forget to subscribe to the LIVEcommunity Blog.     Stay Secure, Kiwi out!   ... View more

Data Loss Prevention (DLP) on Prisma Access   DLP on Prisma Access is a cloud-based service that uses supervised machine learning algorithms to sort sensitive documents into Financial, Legal, Healthcare, and other categories for document classification to guard against exposures, data loss and data exfiltration. These patterns can identify the sensitive information in your cloud apps and protect them from exposure.   While the Prisma Access DLP enhancements resemble the Data Filtering implementation that you use with next-generation firewalls or with Panorama appliances, be sure to follow the steps in "DLP on Prisma Access" to implement DLP with Prisma Access; the configuration tasks are different.   DLP on Prisma Access allows you to protect sensitive file data in the following ways: Prevent file uploads from leaking to unsanctioned web applications. Discover and conditionally stop sensitive data from being leaked to untrusted web applications. Monitor uploads to sanctioned web applications. Discover and monitor sensitive data when it is uploaded to sanctioned corporate apps.   To help you inspect content and analyze the data in the correct context so you can accurately identify what is sensitive data and secure it to prevent incidents, enhanced DLP on Prisma Access is enabled through a cloud service. Enhanced DLP offers over 250 data patterns and many predefined data filtering profiles, and it is designed to automatically make new patterns and profiles available to you to use in Data Filtering policies, as soon as they are added to the cloud service.   Create Data Patterns – Help you detect sensitive content and how that content is being shared or accessed on your network. Create Data Filtering Profiles – Power the data classification and monitoring capabilities available on Prisma Access to prevent data loss and mitigate business risk.   The data patterns and data filtering profiles are designed to work across Prisma SaaS and Prisma Access to provide consistent data security at all locations—either in the cloud or across various enforcement points in the SaaS applications, remote networks, and mobile users. When you create a new data pattern or data filtering profile on Prisma Access, it becomes available for enforcement on Prisma SaaS so that you can identify and protect data uniformly across connected applications.   To improve detection accuracy and reduce false positives, you can also specify: Proximity keywords Confidence levels Basic and weighted regular expressions    Check out all the details of Enhanced DLP.    The following matrix displays what’s supported with DLP on Prisma Access :   WEB APPLICATION PDF DOC/DOCX PPT/PPTX XLS/XLSX RTF CSV MULTI-FILE UPLOADS FILE SIZE Web browsing Yes Yes Yes Yes Yes Yes Yes 20 MB Onedrive Web App Yes Yes Yes Yes Yes Yes Yes 20 MB Sharepoint Web App Yes Yes Yes Yes Yes Yes Yes 20 MB Gmail Web App Yes Yes Yes Yes Yes Yes Yes 20 MB Box Web App Yes Yes Yes Yes Yes Yes Yes 20 MB Slack Web App Yes Yes Yes Yes Yes Yes Yes 20 MB   Additional Information Register and Activate DLP on Prisma Access Enable DLP on Prisma Access View DLP Logs and File Snippets Introducing Prisma Access Release 1.6       Thanks for taking time to read the blog. If you enjoyed this, please hit the Like (thumbs up) button, don't forget to subscribe to the LIVEcommunity Blog.   Stay Secure, Kiwi out! ... View more

Palo Alto Networks SD-WAN subscription integrates with PAN-OS, providing intelligent, dynamic path selection on top of the industry leading security that PAN-OS software already delivers.     Features Introduced in SD-WAN Plugin 1.0.2 Secure SD-WAN provides the optimal end user experience by leveraging multiple ISP links to ensure application performance and scale capacity. For upgrade and downgrade considerations and for specific information about the upgrade path, refer to the SD-WAN 1.0 Administrator’s Guide. The administrator’s guide also provides additional information about how to use the SD-WAN Plugin features in this release.   Below are the new features introduced in SD-WAN plugin 1.0.2 along with PAN-OS 9.1.2-h1, which is required for the SD-WAN 1.0.2 plugin. NEW SD-WAN FEATURES DESCRIPTION Branch Prefix Redistribution (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) Prior to these releases, branch firewalls automatically redistributed all non-public, connected routes to the hub. Beginning with PAN-OS 9.1.2-h1 and SD-WAN plugin 1.0.2, you can also redistribute any additional prefixes to the hub. Automatic Security Policy Rule Allowing BGP (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) For ease of use, you can have Panorama automatically create a Security policy rule to allow BGP between branches and hubs. IKE Preshared Key Refresh (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) Refresh the IKE preshared key that VPN cluster members use. This action is especially helpful if you have a mandate to refresh IKE keys periodically. VPN Tunnel IP Address Ranges (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) Specify IP address ranges for Auto VPN configuration to assign to VPN tunnel endpoints to ensure that Auto VPN does not randomly select IP addresses that overlap with those your network uses. VPN Data Tunnel Support (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) You can now control access to the SD-WAN VPN data tunnel to specify how branch to hub traffic is sent (inside or outside the VPN tunnel). Enable or disable this feature from the SD-WAN Interface Profile. DIA to MPLS Failover (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) Direct Internet Access (DIA) traffic can failover to the hub through the MPLS link to take an alternate route to the internet.   This content was reprinted from the original document in TechDocs. Stay on top of things and bookmark Panorama Plugin for SD-WAN 1.0!       Thanks for taking time to read the blog. If you enjoyed this, please hit the Like (thumbs up) button, don't forget to subscribe to the LIVEcommunity Blog.   Stay Secure, Kiwi out!   ... View more