About jennaqualls

  By: Ben Melamed   As the use of multi-cloud environments continues to rise, adversaries have increased their focus on targeting cloud infrastructure. Cloud environments are seen as an attractive target for attackers, who seek to gain access to sensitive data and resources that are not properly secured by organizations.   The dynamic and complex nature of cloud infrastructure makes it challenging to secure, resulting in a lack of visibility and control needed to promptly detect and respond to security incidents. Cloud-based attacks are becoming more sophisticated and well-funded, using advanced tactics such as cloud cryptojacking, malware campaigns, and cloud misconfigurations. These attacks can be hard to detect and prevent, particularly for organizations that are not well-prepared.   In this article, we will take a closer look at cryptojacking attacks and how you can quickly and effectively respond to help minimize their impact and prevent them from spreading with Cortex XSOAR.   What is Cryptomining?   Cryptomining is the process of using specialized computer software and hardware to verify and record transactions on a blockchain network to earn cryptocurrency.   Think of a blockchain as a digital ledger, where all transactions are recorded in a public and decentralized way. Cryptomining is like being a bookkeeper for this digital ledger. Miners use their computer resources to solve the complex mathematical problems that are required to add new blocks of transactions to the blockchain. When miners successfully add a new block to the blockchain, they are rewarded with a certain amount of cryptocurrency, typically Bitcoin, as a reward for their work.   In simple terms, cryptomining is like digging for digital gold using your computer, and the reward is the cryptocurrency you earn.   Malicious Mining: Cryptomining vs Cryptojacking   Cloud cryptojacking is a type of cyberattack in which attackers use the resources of a cloud computing platform to mine for cryptocurrency without the knowledge or consent of the cloud platform's owner. So while cryptojacking is a process of cryptomining, the main difference is that it relies on the unauthorized use of someone else's resources to mine for cryptocurrency.   An example of a cloud cryptojacking attack would be an attacker gaining access to a cloud platform's API credentials and using them to spin up many virtual machines dedicated to mining cryptocurrency.   Stop Crytpojacking Attacks with Cortex XSOAR   Cortex XSOAR can quickly respond to cryptojacking attacks by automating the incident response process. In the enrichment and investigation phase, XSOAR can gather information about the attack by integrating with cloud platforms like AWS, GCP, and Azure to gather information about the resources that are being used for mining, the IP addresses that are accessing them, and the user accounts that are associated with the API credentials.   Regarding response options, XSOAR can be configured to automatically terminate instances, revoke API keys, and take other actions to stop the attack and contain the damage. Additionally, AI/ML can be used to improve incident response time by detecting signs of an attack and taking action before the attack becomes widespread.   Cryptojacking Response Playbook   The cloud cryptojacking response playbook (part of the Cortex XDR content pack ) provides an automated flow for collecting, analyzing, and responding to malicious cryptomining activity. The playbook is triggered by a Cortex XDR alert that detects unusual allocation of cloud computing resources.     Image 1: Detecting adversary techniques with cloud data   Based on the alert data, XSOAR initiates the automated flow that executes the following:   Enrichment XSOAR enriches all data related to the following: Identity and Access Management (IAM) Enrichment Collects information about the identity used in the attack Resource Enrichment Collects information about the resource type, region, and project Network Enrichment Collects information about the attacker IP address, geo-location, and ASN Then, the collected data is set into a dedicated layout.   Verdict Decision   The verdict is based on a predefined logic which correlates XDR alerts and XSOAR enrichment, based on the following decision tree:   Figure 2: Decision tree for verdict decision   Verdict Resolution   If the verdict is benign or indecisive, a manual task will require the analyst’s intervention. The cloud response playbook will be executed if the verdict is malicious.   Remediation   This playbook provides an automated or semi-manual response action integrating with AWS, GCP, and Azure.     Figure 3: Cloud response playbook triggered   The response actions available are divided into the core building blocks of the cloud:   Compute Resources Terminate/Shut down/Power off an instance IAM Delete/Disable a user Privileges Delete/Revoke/Disable credentials Indicators Block indicators   The Layout   The layout we’ve created for this alert is divided into two main tabs: Incident Info Security Posture The Incident Info tab is mainly focused on presenting high/low-level information of both the incident and alert.   Figure 4: Incident information   The Security Posture tab's goal is to provide detailed information and visualization of the following questions: Who are the involved users? How many instances were created and what is their type? From how many regions was the attack executed? Furthermore, we provide extended information on the attacker's characteristics and a section dedicated to all of the suspicious or malicious indicators found.   Figure 4: Security posture   Conclusion   Cryptojacking attacks have become a serious threat to organizations of all sizes, as attackers seek to exploit the power of cloud computing environments to mine for cryptocurrency. The ability to quickly and effectively respond to these attacks is crucial to minimize their impact and prevent them from spreading.   Organizations should also stay vigilant and aware of the latest trends and techniques in cryptojacking attacks and be prepared to adapt their incident response plans accordingly. Incident response automation and implementing security best practices are crucial in protecting organizations from the growing threat of cryptojacking attacks in the cloud. For more information on the Cryptojacking Response playbook and other XSOAR packs and playbooks, visit our Cortex XSOAR Developer Docs reference page.   Don’t have Cortex XSOAR? Download our free Community Edition today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.   Cortex XSOAR  ... View more

  We wanted to take a moment to thank YOU, our community members for all the support, content and sharing that happened this past month.   We are back to recognize one of our most active contributors with a monthly LIVEcommunity Member Spotlight!    For the January 2023 Member Spotlight, we’d like to applaud one of our community members,  @neelrohit , for their participation and engagement in the LIVEcommunity.     Since joining the community in May 2020, they have written 156  posts , received  37 likes , and authored 41  solutions  (and counting)!   Thank you for your contribution and participation in the community @neelrohit!   We are excited to see you grow as a contributor. We couldn’t do it without our amazing community.    Do you know a LIVEcommunity member you think should be recognized for their contributions to the community? Drop us a comment below!   Thanks for reading and stay tuned for next month’s Member Spotlight. ... View more

  Today, February 7, 2023 is Safer Internet Day !   Over the years, Safer Internet Day has become a landmark event in the online safety calendar.   According to the https://www.saferinternetday.org/ , "from cyberbullying to social networking to digital identity, each year Safer Internet Day aims to raise awareness of emerging online issues and current concerns."   The LIVEcommunity has put together five tips to help you have a safer internet experience.   Make sure that the software you are using is up to date.    I'm talking about the OS, browsers, and all the applications you might be using on your endhost. This is not limited to your desktop, of course! Since mobile shopping has become more popular, make sure your mobile devices have the latest patches and app versions installed. In doing so, you'll greatly reduce the risk of running into known vulnerabilities and getting infected by malware.   Don't use free public Wi-Fi for shopping!   Using MITM (Man in the Middle) methods, attackers might be listening in on your communication and intercept the traffic. It is best to use a trusted Wi-Fi connection like the one at your home. If you aren't at home, then I'd recommend that you turn your smartphone into a hotspot to connect your laptop to the internet.   Use credit cards with online transactions, not debit cards!   Debit cards aren’t covered by fraud insurance policies and provide direct access to the bank accounts they’re linked to. Credit card companies give insurance to buyers if the product isn’t delivered.   Be alert of the information being collected!   Make sure you are aware of the kind of information that's being collected when you make an online purchase. If you're being asked for personal data, like Social Security numbers or password information, then that's a definite red flag !   Always check whether the address is correct before entering your (login) details.   When you go to a website and enter (login) data, check beforehand whether the web address is correct. It is quite possible that you have entered the address incorrectly, which will lead you to a decoy site. These decoy sites are created by criminals with the sole intention of getting their hands on your (login) details.       ... View more

Welcome to our January 2023 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   To kick off the new year, we launched a new LIVEcommunity Member Testimonial program as well as our new PANCast Ideas Submission. Read on to see what happened on LIVEcommunity this past month!    NEW: LIVEcommunity Member Testimonials!     LIVEcommunity is excited to kick off a new series: Member Testimonials. This video series features one-on-one interviews with community members, Cyber Elite experts, and even our very own @kiwi!  Today, we wanted to share a highlight video, which features snippets from many of our members, including @TomYoung, @PavelK, @reaper, @SteveCantwell, @OtakarKlier, @BPry, @SutareMayur, and @Astardzhiev! Watch it now to hear them share how LIVEcommunity has become one of their most trusted resource to build their skills, share ideas, help one another and find solutions.    What PANCast Episode Do You Want to Learn About Next? Share Your Ideas With Us!   Since launching PANCast last September, we have had 10 episodes and now we want your feedback! For the first time ever, LIVEcommunity has launched a new ideas submission area for PANCast. Help support PANCast’s mission to provide actionable insights to customers by sharing what subjects you’d like to hear covered in future episodes.   The Cortex UX Research Lab Is Seeking Participants   The Cortex UX Research Lab is an opportunity to participate in UX research and development for current and future Cortex products.  Simply fill out the Palo Alto Networks UX Research Program Registration Form to be considered for the research lab. It takes less than a minute!.   PANCast Episode 10: How Does Agentless Scan Work?   As the name suggests, agentless scan enables you to protect hosts in the cloud without the multiple installation hassle which can be the worst nightmare for all the Cloud Administrators out there. Basically agentless will discover all supported cloud hosts in AWS, Azure or GCP to initiate scans for all of them automatically once you click on the “Agentless Scan” button. Doesn’t it sound amazing and easy? Because we all know that installing defenders on every host usually takes a lot of time and energy, this is exactly why agentless scanning is here to make life much easier.   Tour the LIVEcommunity!     Let’s take a quick tour of the LIVEcommunity so you can get started right away.  If you're familiar with our community, you'll notice that we've made a lot of improvements, so please hang out with us for a few minutes to see what we have now.   Symphony 2023 Now Open for Registration     Our annual conference is designed to help you solve your most pressing SOC challenges. Symphony brings together the brightest minds in cybersecurity and security operations (SecOps) to share strategies, elevate the role of SecOps and empower you to proactively defend your organization.   Join us on a journey to the modern SOC, where we will share best practices and innovative techniques you can immediately use to improve your SecOps practice in a meaningful way. Plus, we’ll share our vision for transforming the SecOps model as we know it.   Register for Symphony 2023 to learn: Our vision for the future, outlining leading cybersecurity strategies and practices. The latest intelligence and insights into today’s threat landscape. SOC innovation with Cortex® product deep dives, hands-on workshops and new launch announcements.   Tips & Tricks: How to Use 'Disable New Apps' in PAN-OS 10.x and 11.x   Let's talk about the often overlooked feature" Disable new apps in content update ," what it looks like in in PAN-OS 10.x and 11.x, and how to use it.   How to Evaluate Spam From an Incident Response Perspective   Wikipedia defines Spam as email spam, unsolicited, undesired, or illegal email messages.  This generic definition leaves a lot of room for interpretation.  The good news is,  whether it's spam, email phishing, or another kind of spam, they can all be addressed in a similar fashion with Cortex XSOAR.   Simplify User Access Without Upgrading Your Infrastrcuture With User Context   With our latest PAN-OS 11.0 Nova release, security endpoints don’t need to be configured individually and network administrators have a holistic view of user activity and devices within their networks.To ease this problem, the Palo Alto Networks identity team created User Context: a new tool to simplify and unify distribution of user-ID and other user mappings across all infrastructure for centralized visibility.    A Day in the Life of a Cloud Security Researcher   You might have seen a Cloud Security Researcher in the news recently. They're the ones who work to prevent data breaches and other cyber attacks that can put your personal information at risk. No two days are alike for a Cloud Security Researcher.  In this article, we'll take a closer look at the job and explore some of the key responsibilities involved.   Jan ‘23 Discussion Highlight: Posts With Accepted Solutions   Nominated Discussions help LIVEcommunity Solutions Engineers highlight a discussion that has an Accepted Solution , and turn it into an article with additional helpful information, documentation, and clarity! Here are the Nominated Discussions we published this past month:   Nominated Discussion: Creating an IPSEC Tunnel to ASA Nominated Discussion: Precedence of Routing\NAT\Policy Nominated Discussion: ISP Failover and DHCP Nominated Discussion: "Show URL-Cloud Status" Returns Nothing Nominated Discussion: Creating an AE interface via CLI Nominated Discussion: Push to the Firewall fails with status 'none' and error details 'no details' Nominated Discussion: How to Change Forward Decrypt Trust Certificate   More resources that customers might find helpful: PAN-OS Updates: EoL, Preferred Release, and Known Issues  Cortex XDR PoC: Software Installations Blocking XSOAR 8: Re-Architected for Performance, Scalability, and Reliability  Playbook of the Week: Automate NGFW Management with Cortex XSOAR  XSOAR Engines and Oversharing-Risk Prevention During Incident Response  How to Add Log Forwarding Profiles in All Security Policies  Did You Know You Can Configure Resources Per VSYS?  Playbook of the Week: Uncovering Unknown Malware Using SSDeep  ... View more

  Suggest a PANCast topic here.   PANCast is a Palo Alto Networks podcast that provides actionable insights from cybersecurity experts to customers, helping ensure each day is more secure than the one before it.   Since launching last September, PANCast has produced and published 10 episodes — including titles like “Should you have SSL Decryption Enabled?” and “Migrating to a Palo Alto Networks Firewall? Here’s What You Need to Know.” Now, we want your ideas for future episodes!   Please share what topics you'd like to hear covered, simply by clicking "Suggest an idea" via this PANCast Ideas page.     Here's how to submit an idea for PANCast:     Simply hover over PANCast on the navigation bar; then click PANCast: Episode Ideas Submission.     Now that you have landed on the  ideas page , leave your insights by clicking "Suggest an idea."   Thank you for helping support PANCast and Palo Alto Networks customers!    Submit your idea now.   ... View more

Automate Workflows Using Threat Vault   By Bar Katzir, Product Manager   As a security analyst, staying up-to-date on the latest threats is a crucial part of your job. This can be a time-consuming task, especially if you are manually researching vulnerabilities, exploits, viruses, and spyware. That's where Threat Vault comes in.   Threat Vault is a threat intelligence platform integrated into Cortex XSOAR , a security orchestration, automation, and response (SOAR) platform. With Threat Vault, you can easily research the latest threats and see how they can be detected and prevented by Palo Alto Networks’ Next-Generation Firewalls.   One benefit of Threat Vault is that it helps automate workflows. Instead of manually researching threats, you can use Threat Vault to quickly and easily access the information you need. This frees up your time to focus on critical threat analysis and response.   Figure 1: Threat Vault integration view within the Marketplace Threat Vault can help you get contextual information on these common threats when performing an investigation in your security operations center (SOC): Viruses - Piece of code injects itself into an application. Worms - Malware that exploits software vulnerabilities and backdoors to gain access to an operating system. Trojans - Malicious code or software that poses as an innocent program, hiding in apps, games, or email attachments. Spyware - Malicious actors gain access to an unsuspecting user’s data, including sensitive information such as passwords and payment details. How Does Threat Vault Work?   Threat Vault gathers threat intelligence from a variety of sources, including data from third-party providers and Palo Alto Networks' own research. This information is then organized and stored in a centralized location, making it easy to access.   Figure 2: Threat Vault instance configuration module   To use Threat Vault, simply log in to Cortex XSOAR and access the Threat Vault integration. From there, you can search for specific threats or browse the latest threats by category.   Figure 3: Threat Vault Autorun User-Agent traffic Spyware signature   Figure 4: Threat Vault Worm/Win32.autorun.crck Antivirus signature You can also search for threats that are associated with a specific type, or vendor, or CVE in case you want to perform a more speaker-headed investigation.     Figures 5-6: Threat Vault Vulnerabilities related to the vendor MS11-045   The Full Benefits of Threat Vault   Threat Vault can also be used to see how specific threats are detected and prevented by Palo Alto Networks’ Next-Generation Firewalls. But Threat Vault doesn't just provide information on the latest threats, it can automate your workflow by creating incidents in Cortex XSOAR. For example, you can set up a daily incident that fetches the Threat Vault release notes and automatically creates an incident in Cortex XSOAR. This can help you stay up-to-date on the latest threats without manually checking for new information. Another feature of Threat Vault is its ability to provide actionable intelligence. It not only provides information about the latest threats but also provides recommendations for how to mitigate those threats. This can be incredibly valuable to security analysts, as it helps prioritize efforts and make more informed decisions about how to protect their organization.   Conclusion   Threat Vault is a valuable tool for security analysts looking to automate their workflows and stay up-to-date on the latest threats. By providing access to actionable intelligence and integrating with other security tools and platforms, Threat Vault helps you quickly and easily research and respond to threats, freeing up your time to focus on more important tasks. And with the ability to create incidents in Cortex XSOAR based on Threat Vault release notes, you can stay informed about the latest threats without having to check for updates manually.   For more information on the Threat Vault content pack, refer to the pack documentation here. If you like these ideas or would like to suggest other ideas, please collaborate with us through the Cortex XSOAR Aha page . Please suggest ideas or vote for others.   Don’t have Cortex XSOAR? Download our free Community Edition today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC. ... View more

Customers With a CSP Account Who Are New to LIVEcommunity   Instructions: Log into Customer Support Portal (CSP): support.paloaltonetworks.com/ Go to LIVEcommunity. This can be done two ways: Option 1  Select "Resources" from the left-aligned menu of the CSP homepage Click on "LIVEcommunity" Click the "Sign In" button at the top right-hand side of the LIVEcommunity homepage If you are logged into CSP, you will automatically be logged into LIVEcommunity  Option 2 Go to the LIVEcommunity homepage (https://live.paloaltonetworks.com/)  Click "Sign In" in the upper-righthand corner If you are logged into CSP, you will automatically be logged into LIVEcommunity    LIVEcommunity Users Who Are Registering With CSP for the First Time  Instructions: Register with the Customer Support Portal (CSP) using one of two methods: Have your company Superuser create an account for you OR Self-register by following this guide: How to Create Your Customer Support Portal User Account Then: Go to LIVEcommunity and select the "Sign In" button You will be automatically logged in using SSO You will then be able to see customer content in LIVEcommunity  Note:  If you have more than one LIVEcommunity account, please reach out to community@paloaltonetworks.com to have them merged.   Customers Who Are New to Both CSP and LIVEcommunity Instructions: Register with the Customer Support Portal (CSP) using one of two methods: Have your company Superuser create an account for you OR Self-register using this guide: How to Create Your Customer Support Portal User Account Once registered and logged in to CSP, either: Click on the "Resources" option on the left-hand side menu and select LIVEcommunity OR Follow this link to LIVEcommunity and select "Sign In" in the upper-righthand corner. You will be automatically logged in using SSO.   You can read more in LIVEcommunity's FAQ. ... View more

    Watch This Brand-New Member Testimonial Video!   LIVEcommunity is excited to kick off a new series: Member Testimonials. This video series features one-on-one interviews with community members, Cyber Elite experts, and even our very own @kiwi!    Today, we wanted to share a highlight video, which features snippets from many of our members, including @TomYoung, @PavelK, @reaper, @SteveCantwell, @OtakarKlier, @BPry, @SutareMayur, and @aleksandar.astardzhiev! Watch it now to hear them share how LIVEcommunity has become one of their most trusted resource to build their skills, share ideas, help one another and find solutions.    Don’t forget to subscribe to the Member Testimonial area to get a notification when a new post is published.  ... View more

I would like to customize the standard "Detections By Actions" widget to filter only on true positive (resolved) incidents - for the last 30 days.  And I would like to customize the standard "Open incidents by severity" widget to apply on all incidents, not only opened ones - for the last 30 days. I suppose it's possible by XQL-query but I'm a beginner in XQL-query scripting ...   Does anyone have XQL-query script doing something nearby? ... View more

  Palo Alto Networks recently announced   its next wave of innovations with PAN-OS 11.0 Nova, featuring 50+ product updates and innovations to help keep organizations one step ahead of attackers. Not only will attendees learn how Palo Alto Networks can help them outpace evolving cyber threats, but they’ll get a sneak peek into our five fourth-generation ML-Powered NGFWs. This is an event you don’t want to miss! Register for the PAN-OS 11.0 Nova Launch Event now!   Event details: Americas -  January 31, 2023, 10 AM PST Europe - 01 February 2023, 10 AM CET Asia-Pacific - 01 February 2023, 11:30 AM SGT     Advanced WildFire - Stops 26% more zero day malware than traditional sandboxes Advanced Threat Prevention - Detects 60% more unknown injection attacks than traditional IPS solutions Web Proxy - Integrate proxy on NGFW, secure all traffic with one platform NG-CASB - Integrate CASB on NGFW, secure all apps and data with one platform AIOPs 2.5 - Easily adopt cyber security best practices, proactively address misconfigurations 5 New ML-powered NGFWs - Up to 5x the performance of previous generation, flexibility of fiber and Power over Ethernet (PoE)   We look forward to seeing you there!   ... View more

By Alon Yardeni Cortex XSOAR 8 is Available Now!   Cybersecurity is now demanding true end-to-end automation. An extremely smart and efficient architecture is necessary to support a new generation of automated actions while fitting in seamlessly with the SOC workflow. XSOAR 8 delivers a solution to these needs with its new SaaS deployment.   XSOAR 8 offers the benefits of tight integration with the industry-leading Cortex Platform and its other cybersecurity products. In addition, XSOAR 8 delivers new capabilities and features designed to boost the effectiveness and efficiency of the Security Operations Center.   Uniting with the Cortex Platform Bringing together best-in-class threat detection, prevention, attack surface management, and security automation capabilities into an integrated platform, Cortex enables the building of an adaptable and responsive SOC that’s designed for a constantly evolving threat environment. XSOAR 8 integrates with the rest of the Cortex platform and its best-in-class products (XDR, Xpanse, XSIAM) to offer SOCs: Unified UI and UX Simplified deployment and onboarding Consistent user management Customers interested in growing their Cortex portfolio will especially appreciate the comfortable user experience and simplified flows shared across products.   Running Faster, Smoother and Doing More Beyond Cortex integration, XSOAR 8 achieves the customer goals of improved performance, reliability, and scalability. It introduces a new cloud-native architecture built on top of GCP delivered from many regions around the globe, including US, Canada, UK, Netherlands, Singapore, and Japan. XSOAR 8 cloud users gain value from the scalability of data storage, the API layer, and more. XSOAR 8 is already compliant with SOC 2, while FedRAMP Medium with High compliance on the way.     XSOAR 8 Incident window   XSOAR 8 Availability For new customers, XSOAR 8 for the cloud is available now.   Existing XSOAR hosted customers will be able to migrate to XSOAR 8 for the cloud from February to June 2023. We will coordinate the migration with each customer individually.   Likewise, existing XSOAR on-prem customers may migrate to XSOAR 8 for the cloud from February 2023. XSOAR 8 for on-prem and MSSP deployments are scheduled for later in 2023.   XSOAR 8: Find Out More  More information can be found in the Cortex XSOAR 8   release notes   and   FAQ.   Current and new customers are invited to contact their Palo Alto Networks Sales and Support Reps to learn more and to schedule a   demo. ... View more

  We wanted to take a moment to thank YOU, our community members for all the support, content and sharing that happened this past month.   We are back to recognize one of our most active contributors with a monthly LIVEcommunity Member Spotlight!    For the December 2022 Member Spotlight, we’d like to applaud one of our community members, @sunright, for their participation and engagement in the LIVEcommunity.   Since joining the community in September 2011, they have written 288 posts , received 36 likes , and authored 56 solutions (and counting)!   Thank you for your contribution and participation in the community @sunright!   We are excited to see you grow as a contributor. We couldn’t do it without our amazing community.    Do you know a LIVEcommunity member you think should be recognized for their contributions to the community? Drop us a comment below!   Thanks for reading and stay tuned for next month’s Member Spotlight.   ... View more