About jforsythe

Welcome to our Member Testimonial video series, where we invite members to share why LIVEcommunity is their trusted resource for building skills, sharing ideas, troubleshooting issues, and finding solutions!   @SCantwell_IM has been a member of LIVEcommunity since 2019 and part of community’s Cyber Elite program — which recognizes our most committed, helpful, and knowledgeable members — since it launched in 2020. He is an involved, responsive, and thoughtful member, and we’re grateful to have him as a part of LIVEcommunity: To date, he has made 745 posts, given 191 kudos and created 95 accepted solutions!   Achieving Cyber Elite status on the LIVEcommunity means a lot to Cantwell, as it recognizes his expertise and commitment to providing the best possible solutions to his customers. He is an expert at leveraging the technical content available on the platform, including white papers and implementation guides, to stay up-to-date on the latest cybersecurity trends and technologies. Many posters in our discussion areas have Cantwell to thank for solutions; Cantwell is extremely active in our forums and mentioned that he looks for unanswered questions in hopes of helping out folks experiencing a road-block.   "It just makes sense that I could offer out my expertise to be able to assist not just one person that has an issue, but any other future engineers and/or customers that might be exhibiting the same issues,” shared Cantwell in his interview.    Learn more about what community brings to Cantwell’s professional and personal development in this special Member Testimonial video:     The LIVEcommunity team would like to extend a special thank you to Patrick Spencer of TIRO Communications for his help on the production of this series.   Subscribe to LIVEcommunity’s Member Testimonial area to get notified when we post a new video!   ... View more

  This post was authored by Qiang Huang and contributed to by Minakshi Sehgal.   I lead product management for Palo Alto Networks IoT and OT security products. Over the past few years, I've worked with customers in just about every vertical to help secure their IoT and OT devices. In that time I've come to understand the unique challenges facing industries that rely on OT devices. For example, manufacturing was the industry most impacted by cyberthreats in 2022, with a 50% increase in ransomware attacks. This is because the threat surface is rising exponentially as digitization initiatives lead to more vulnerable legacy and newer types of OT assets connecting to the IT network, cloud, and Internet. And the attackers know that many vulnerable OT assets are not patched, giving them an easy way in. Cyber attacks are increasingly disrupting manufacturing production, and CXOs are realizing that their current security measures are simply not enough to cope with changes in the OT network at their production facilities.    CxOs need comprehensive cybersecurity that protects OT networks at all times against all threats without impacting operations.    Today, Palo Alto Networks is excited to announce Industrial OT Security, part of our comprehensive Zero Trust OT Security solution. Industrial OT Security is a new service that provides the most comprehensive Zero Trust security for OT assets. This new solution was purpose-built to address three key challenges faced by CxOs in asset intensive industries.   Getting clear visibility into OT assets, their communications, and risk factors.  Their current lack of visibility leads to ineffective segmentation and security as the OT boundaries are no longer static due to digitization and remote operations trends. Keeping up with the evolving and increasingly sophisticated threats. Many connected OT assets are vulnerable, exposed, and difficult to patch, making them a great entry point for attackers to infiltrate. Meeting stringent operational requirements. OT organizations have important operational considerations, such as stringent change management procedures to avoid downtime and complex device ownership with OEMs and SIs. This challenges existing security measures, such as patching, vulnerability scanning, and endpoint security. As a result, many OT assets are not up-to-date and secured, even if they are known to be vulnerable.   Securing increasingly dynamic OT networks and ensuring ongoing operations requires adopting a Zero Trust approach.    Rooted in “never trust, always verify,” Zero Trust is designed to protect modern industrial and enterprise networks. As OT environments are becoming increasingly dynamic with regard to OT assets and network communications, the principles of Zero Trust  provide an effective framework for security systems and processes. Given that most OT processes are purpose-built with predictable network traffic, Zero Trust principles are ideal for securing OT assets to prevent damage to the assets and downtime for critical services while preserving human health and safety.   Key steps to leverage Zero Trust to improve security in OT environments, include:   Comprehensive and ongoing visibility of the OT assets, their communications, and risk factors, such as CVEs and other vulnerable postures. Visibility is the foundation for prioritizing which surfaces to protect and for architecting Zero Trust for OT networks.  Contextual segmentation to partition vulnerable OT networks and assets from IT and cloud assets. Critical OT processes can be further segmented based on risk prioritization and mission criticality (e.g., leverage IEC 62443 security levels and zoning best practices). Least privilege access can also be used to control external communications for legacy and vulnerable OT assets that are hard to patch. Continuous verification of trust for OT asset identity, behavior, and risk conditions and combined with adjustments made to security policies to reflect known risks.  Continuous security inspection of all traffic at the segmentation boundary - even for allowed communications, to detect and prevent malicious activities and ensure OT process integrity from attacks.   These steps can also help you to simplify the implementation and compliance reporting required for OT industry standards, such as IEC 62443.   Only Palo Alto Networks provides complete Zero Trust security so you can focus on uninterrupted operations and continued modernization of your production facilities.   Most vendors out there today stop at step one. With the new Industrial OT Security service on Palo Alto Networks NGFWs and Prisma® Access, Palo Alto Networks is the only true Zero Trust security solution that provides comprehensive visibility and security for your OT assets. Industrial OT Security covers all connected assets in plants and remote substations and sites, enabling your digital transformation while maintaining uninterrupted operations.   Palo Alto Networks Industrial OT Security solution allows you to achieve unprecedented levels of protection with:   1. Comprehensive visibility across OT and IT asset identity, communications and risk factors using machine learning (ML) with crowdsourced telemetry. Industrial OT Security, when combined with our NGFW, recognizes hundreds of unique OT asset profiles and 1000+ OT/ICS applications. It then establishes a comprehensive inventory of OT assets, visually maps their transaction flows in the context of the OT Purdue model, and provides insights into their risk exposure (e.g., CVEs, unsupported OS, connections to risky destinations). You can leverage this new ongoing visibility to establish protection surfaces, discover segmentation gaps, and prioritize your risk remediation. Unlike some traditional approaches, the asset visibility is non-intrusive to your OT processes, meaning no disruptions.   2. Zero Trust Security for OT assets and networks. Based on OT and IT asset visibility and risk assessment, our solution establishes and enforces Zero Trust security with these capabilities: Contextual segmentation secures your OT perimeter with effective segmentation of your OT networks from the corporate IT and the Internet. Further zoning and microsegmentation secures OT processes based on your OT assets, the criticality of OT processes, and risk contexts.- Dynamic least privilege access policy with elegant policy constructs of  Device-ID, App-ID, and User-ID, natively on the NGFW. This helps to secure legacy, vulnerable, and hard-to-patch OT assets that need to communicate to external networks. Industrial OT Security also establishes baseline OT asset behavior to help you eliminate error-prone and time-consuming manual policy creation. Continuous trust verification with real-time OT asset identity, behavior, and risk condition monitoring. With Device-ID, your security policy can be dynamically updated based on the latest trust verification.  Continuous security inspection with threat prevention of IT exploits and OT-specific threats based on advanced ML and 600+ OT-specific threat signatures,and behavior anomaly detection for zero-day threats. It also monitors your OT process integrity with customized alerts and policy actions for events, such as PLC stop and program download. Simplified operations with the most comprehensive unified platform that is equipped with playbook-driven, native integrations with your back-end systems. Industrial OT Security is flexible and easy to deploy, across hardware, virtual and cloud-deployed NGFW form factors, without requiring multiple sensors and network redesign. It also supports partially air-gapped to fully connected architectures. Industrial OT Security is available as a cloud-delivered service with ML-powered NGFWs  and with Prisma® Access.    Industrial OT Security delivers high ROI with less complexity than other solutions.   In addition to lowering the risk for industrial OT environments, the solution has been shown to provide a 351% return on investment (ROI) with up to 95% lower complexity than alternative OT security solutions. Find out how you can improve the security of your OT ecosystem and simplify operations. Read the latest Economic Impact Report from Enterprise Strategy Group (ESG).   Find out more: Palo Alto Networks Zero Trust OT Security.   ... View more

Has the PANCast team considered talking about certifications / PCNSE in an episode? I know that a lot of LIVEcommunity members are interested in certification- and credential-related content. ... View more

  Playbook of the Week: Uncovering Unknown Malware Using SSDeep by Ido Van Dijk   Cryptographic hashes like MD5 are often used to identify malware, but as malware evolves, new iterations of the same malware are being released constantly. Malware may be modified or modify itself to avoid detection by traditional hashes. For example, in 2018, 12,000 variants of the WannaCry ransomware were detected in the wild. SSDeep has proven effective in identifying malware of the same family, as large portions of the code usually remain the same between versions.   In this post, we’ll explain how to improve the detection, enrichment and investigation of malware by leveraging the power of SSDeep, a fuzzy hash often used in digital forensics, research and incident response. Yet, before talking about SSDeep, let’s talk about cryptographic hashes.     Cryptographic hashes vs. fuzzy hashes   Cryptographic hashes are used to identify data. In digital forensics, they serve as a means of identification of files. They are used to answer the question: “Is file X exactly the same as file Y?” A change in one bit of a file will cause a completely new cryptographic hash to be produced for that file. Some of the most commonly used cryptographic hashes are MD5, SHA-256 and SHA-512.   What exactly is SSDeep?   SSDeep is a fuzzy hash, and is a type of Context-Triggered Piecewise Hash (CTPH). It is calculated differently from the previously mentioned hashes, and is produced by running a hash function on fixed size segments of the file. This produces a special hash that answers the question: “Is file X similar to file Y?”. Therefore small changes in a file will only slightly alter the SSDeep hash it produces.   Let’s look at an example. Here are 2 files with the difference in only 1 byte:     Let’s look at the SHA-1 produced for those files:   As you can see, a completely different SHA-256 hash is produced for each file. Let’s take a look at the SSDeep hashes of those files:   The SSDeep hash is almost identical, except for one character difference. Why use fuzzy hashes?   As we saw before, cryptographic hashes can help us uniquely identify malware. If we find a suspicious file, we can query our threat intelligence products to see whether they know about its MD5 hash, and we may get insightful results about the malware. However, if the malware we are investigating was forked and made the slightest modification of a string for example, then the method of enriching it using its MD5 hash may not yield any results at all, unless that exact fork is known to the threat intelligence product we are using.   This is where SSDeep comes in.   SSDeep is a common implementation of CTPH. The “ssdeep” command is a native command in Unix systems, and it has a built-in function that allows us to find files with similar SSDeep hashes. We may find out that we have just investigated a very similar malware the week before, which has a similar SSDeep, but its MD5 hash is not known to any of our sources.   Leveraging SSDeep in XSOAR to uncover unknown malware   Combining SSDeep with Cortex XSOAR provides a tremendous value due to the following capabilities:   Threat Intelligence Management (TIM) module Fetch indicators from feeds. Fetch indicators from incidents. Get reputation based on multiple sources (sandbox. threat intel, manual). Build relationships between entities. Integration Integrate with threat intelligence products for indicator enrichment. Integrate with EDRs, firewalls, email security gateways and more - to provide a holistic remediation plan. Automation Automatically detect files with similar hashes. Automatically hunt for files in endpoints. Automatically remediate. Case Management Link similar incidents together. Display all relevant information in a special custom layout. Taking into account all of the tools we have, we created the following general flow in an XSOAR playbook: We obtain an MD5 hash from an alert on one of our endpoints. We retrieve the file from the endpoint, to obtain its SSDeep hash. We generate a pool of SSDeep hashes that we know about. We use existing SSDeeps in our system (from various feeds and incidents we have), and we enrich other hash types using threat intelligence tools to obtain even more SSDeep hashes.     4. We use an automation we provide out of the box called SSDeepSimilarity, to find similarities between the file we started with and the SSDeep hashes from the pool.       5. We begin to pivot: - We create relationships between our original hash and previously unknown hashes by uncovering the SSDeep similarity of the original SSDeep hash and the hashes from the hash pool. - We link the current incident with another incident where the similar hash came from. This provides us with additional IOCs which may be related to the malware we are investigating. - We search for the similar hashes we found on our endpoints, and we detect one of them on an endpoint.     6. Finally, we save all of our findings in the incident layout and allow for remediation of any malicious indicators found in our investigation.   To start using the SSDeep content pack, visit the Cortex XSOAR marketplace. For more information on SSDeep, check out the SSDeep project or detailed research on the value of fuzzy hashing in malware analysis.   Don’t have Cortex XSOAR? Download our free Community Edition today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.   ... View more

How to automate NGFW management using Cortex XSOARBy Danil Vilenchik, Sr. Technical Program Manager   Today’s security operations centers (SOCs) are plagued with lengthy investigation times and security teams are often drowning in repeatable, manual tasks. Combine these challenges with the tedious and time-consuming task of firewall management, and it's no wonder that more than one-third of IT professionals are considering quitting their job in the next six months.   Fortunately, there are solutions that exist to help automate many of the SOC’s most common processes, relieving some of the burden faced by security analysts. In this post, we’ll take a deeper look into the PAN-OS by Palo Alto Networks content pack for Cortex XSOAR, which assists in managing firewall objects, rules and policies as well as the firewall instances themselves. This helps create a safer browsing environment and block unwanted traffic flowing into and out of organizations.   What is PAN-OS?   PAN-OS is the software that runs all Palo Alto Networks® next-generation firewalls. By leveraging the key technologies that are built into PAN-OS natively (App-ID, Content-ID, Device-ID, and User-ID) you can have complete visibility and control of the applications in use across all users and devices in all locations. Because inline ML and application and threat signatures automatically reprogram firewalls with the latest intelligence, all traffic on your network is free of known and unknown threats.   Benefits of the PAN-OS content pack   The PAN-OS content pack for Cortex XSOAR enables SOC teams to create and manage security rules, update security policies, make sure devices and policies meet security best practices and take action when needed for device management. Over 250 manual commands can be executed from the XSOAR CLI and 18 generic playbooks help automate security and network operations. Utilizing Cortex XSOAR to control and manage network security operations consolidates security tools and many of the out-of-the-box commands can be used to further build playbooks to eliminate manual actions.   Integrating PAN-OS with XSOAR helps to automate many of the time-consuming tasks associated with firewall operation and management, freeing up SOC teams to work on more critical security issues.   See Cortex XSOAR and PAN-OS in action   Let’s look at how Cortex XSOAR and PAN-OS can automate basic remediation steps.   When a new malicious IP or URL indicator is detected in Cortex XSOAR, it automatically triggers a playbook that adds the malicious indicator to a block list. The playbook first checks to see if the address already exists in the block list, and if not, the indicator is added.   PAN-OS - Block IP - Static Address Group playbook   This may seem like a simple task that can be performed manually, but in reality, when analysts are flooded with many tasks and pending investigations, it becomes critical to remove items from their list of actions. Cortex XSOAR can help! Automating processes is one of the key pillars of SOAR solutions. Real threats won’t go ignored or even missed, and indicators can be quickly found within your environment to follow up with further investigation.   Threat-hunting made easy with XSOAR and PAN-OS   XSOAR can automatically run through your PAN-OS logs each time a new IOC is detected.   Proactive hunting is important to keep your environment safe, and as daily security incidents and escalations flood the SOC, high-tier analysts and engineers will no longer have to waste their time running queries on FW logs.   PAN-OS Query Logs For Indicators playbook   Each malicious file (hash), URL and IP fetched into XSOAR is automatically queried by this playbook in up to six different logs in your PAN-OS instance, including Wildfire malware protection engine, threat, traffic, data and more.   Palo Alto Networks offers a whole suite of best-of-breed security solutions. Implementing the PAN-OS by Palo Alto Networks content pack in your standard workflows can save time that is normally wasted on basic manual actions and allow your security personnel to focus on other responsibilities, shorten SLAs and increase SOC efficiency.   For more information on the PAN-OS by Palo Alto Networks content pack, refer to the developer article here. If you like these ideas or would like to suggest other ideas, please collaborate with us through the Cortex XSOAR Aha page. Please suggest ideas or vote for others.   Don’t have Cortex XSOAR? Download our free Community Edition today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC. ... View more

Symphony 2023: Journey to the Modern SOC   Symphony 2023 is back!   Our annual conference is designed to help you solve your most pressing SOC challenges. Symphony brings together the brightest minds in cybersecurity and security operations (SecOps) to share strategies, elevate the role of SecOps and empower you to proactively defend your organization. Join us on a journey to the modern SOC, where we will share best practices and innovative techniques you can immediately use to improve your SecOps practice in a meaningful way. Plus, we’ll share our vision for transforming the SecOps model as we know it. Register for Symphony 2023 to learn:   Our vision for the future, outlining leading cybersecurity strategies and practices. The latest intelligence and insights into today’s threat landscape. SOC innovation with Cortex® product deep dives, hands-on workshops and new launch announcements.   Register for Symphony 2023 today!   ... View more

A retrospective look at the accomplishments and highlights from LIVEcommunity in 2022.   Can you believe another year has come and gone? These past 12 months have no doubt been eventful and we’d like to take a moment to reflect on all that was accomplished.   In 2022, LIVEcommunity made significant improvements. We redesigned our homepage navigation, developed new product pages and customer journey guides, won our first big industry award, published hundreds of helpful blogs and articles, and our members continued to engage in the kind of problem-solving and solution-finding that sets this global community apart.    The LIVEcommunity team appreciates all of those who visited us in 2022, and would like to extend a special thank you to users who provided feedback in the form of comments, mentions, thumbs up/kudos, and replies to posts. We wouldn’t be this vibrant community without each and every one of you!    2022 in LIVEcommunity: By the Numbers   PAGE VIEWS 9,562,584   VISITS 5,242,336    POSTS 21,336   KUDOS GIVEN 6,844   ACCEPTED SOLUTIONS 1,324   LIVEcommunity's Most Popular Blogs From 2022   New Advanced URL Filtering/PANDB Category: Ransomware New Advanced URL Filtering/PANDB Category: Encrypted-DNS Tips & Tricks: How to Ping from the CLI  DOTW: GlobalProtect Virtual Adapter Was Not Set Up Correctly Due to a Delay  Russia-Ukraine Cyber Activity Resources   2022 LIVEcommunity Highlights   LIVEcommunity Won a 2022 Khoros Kudos Award   One of our greatest achievements in 2022 was winning a Khoros Kudos Award. This is the first year LIVEcommunity won a Khoros Kudos award, and we hope it signifies our steadfast commitment to our members and Palo Alto Networks customers around the world.   We Built a New Member Recognition Area!     LIVEcommunity is nothing without its members, which is why we launched a new Member Recognition area earlier this fall.    The Member Recognition area features our Cyber Elite Program and Spotlight News. In the Cyber Elite Program area, you’ll find information about each of our Cyber Elite experts, as well as details about the program (more on that below), while in the Spotlight News area, you'll find our monthly Member Spotlight series which highlights members that have been active in posting discussions, making comments, and giving likes.   LIVEcommunity Welcomed Our 2022-23 Cyber Elite Cohort     ​​The LIVEcommunity team wants to give a shout-out to our 2022 Cyber Elite experts! Cyber Elite experts are highly knowledgeable and engaged members who go above and beyond in their contribution to community.   Earlier this year, we welcomed two new Cyber Elites to this group of super-users, @PavelK and @TomYoung. Thank you to all 11 of our Cyber Elite experts who make this online community as vibrant, helpful, and connected as it is!   PANCast, a Palo Alto Networks Podcast, Launched     Have you listened to PANCast yet? This Palo Alto Networks podcast provides actionable insights from cybersecurity experts to customers; episodes will cover a range of Palo Alto Networks products, offering valuable tips and key information for a successful adoption journey. Check out these episodes from @jarena:    PANCast Episode 1: Four Things You Must Do When Upgrading Your Firewall PANCast Episode 2: How Does GlobalProtect Split Tunneling Work? PANCast Episode 3: URL Filtering — Allowing and Blocking the Right Traffic PANCast Episode 4: Why Is My Dataplane CPU So High? PANCast Episode 5: Why Logs Are Your Best Friend PANCast Episode 6: Understanding Firewall Security Policies PANCast Episode 7: What to Know When Migrating to a Palo Alto Networks Firewall   We Introduced Nominated Discussions for the Community Knowledge Base   LIVEcommunity moderators can now nominate a discussion topic to be an article. This is a great way for members to be able to contribute to our community knowledge base. Here’s a list of our favorite member-posted discussions we turned into articles in 2022:   Palo Alto Free Workshops, Trainings, Trials, and PCNSA/PCNSE Training Global Protect Authentication Happened Two Time While Using RADIUS URL Filtering Profile Set to Allow Ransomware Dual ISP Global Protect Redundancy   Thank you for contributing meaningful topics, replies, and solutions to LIVEcommunity's reservoir of knowledge!   LIVEcommunity Got a New Navigation Bar     Earlier this year, LIVEcommunity updated its homepage navigation! We simplified the navbar and drop-downs in an effort to fine-tune way-finding, organization, and overall user experience. Rather than having blogs, articles, and discussion hidden under Collaboration, these important LIVEcommunity resources now have their own spots in the nav. Products and Tools now have their own drop-downs, where you can hover to find your relevant assets.   Learn all about the changes here.   We Unveiled Cloud NGFW for AWS Help Center       Earlier this spring, Palo Alto Networks announced Cloud NGFW along with Amazon Web Services (AWS). Managed by Palo Alto Networks and easily procured in the AWS Marketplace, the service has been designed to easily deliver our best-in-class security protections with AWS simplicity and scale.   LIVEcommunity’s Cloud NGFW for AWS Help Center page is where you will find FAQs, videos, technical resources, discussions, blogs, and articles related to the deployment and use of Cloud NGFW for AWS. Check it out now.   New Customer Configuration Centers for NGFW and Panorama   In an effort to better serve our customers, LIVEcommunity enabled new, customized configuration help centers for Next-Generation Firewall and Panorama in 2022.   We want our customers to have the tools they need to properly configure, setup, and deploy their products. These new customer configuration areas for NGFW and Panorama are home to key documentation and resources to support your configuration needs. The customer Configuration Centers are available to you every day, all day.   Check them out now: Panorama Customer Configuration Center Next-Generation Firewall Customer Configuration Center    We Created New Technology Pages:   One of our main goals in LIVEcommunity is being home to the newest and most up-to-date resources on Palo Alto Networks technology. This year, we launched a several new technology pages:   Cloud NGFW for AWS Help Center AIOps for NGFW Prisma SD-WAN (including a Customer Journey Guide and Self-Help Resources)  Panorama Customer Configuration Center NGFW Customer Configuration Center Best Practice Assessment Plus (BPA+) Prisma Access for Multi-Tenant Platform (MSPs)   We hope these pages help you in adopting, leveraging, and learning about your Palo Alto Networks product.   As we say goodbye to 2022 and hello to 2023, we want to THANK YOU for being an integral part of our members' success and exemplifying the true meaning of “community.”    LIVEcommunity is Now Available in Chinese In 2022, LIVEcommunity launched a brand new community in Simplified Chinese. You can find it and Japan at the top of our navigation on our homepage.    Thank you to our global community for making 2022 such a successful year. Here's to an even better 2023!   ... View more

December 2022 Rewind: Top posts from LIVEcommunity   Welcome to our December 2022 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   In December, we attended Ignite and connected with some LIVEcommunity members IRL; discussed new networking features in PAN-OS 11.0 Nova with the community; shared new episodes of PANCast, a Palo Alto Networks podcast; and much more. Read on to see what you missed in LIVEcommunity in December, a noteworthy finale to 2022 🎉.   Ignite '22 Recap   Another Ignite conference comes to an end! If you joined us last week in Vegas for Palo Alto Networks annual cybersecurity conference, Ignite 2022, we want to thank you for stopping by the LIVEcommunity booth. If you missed this year's sessions, don’t worry: many of them can be watched on-demand by logging into your account on the Ignite page and clicking on the top right-hand side menu.   The LIVEcommunity team also wants to extend a big thank you to our very own Cyber Elite experts @BPry, @TomYoung, and @MP18 for hanging with us at Ignite. Check them out playing Topgolf with LIVEcommunity manager @crasmussen.    We can’t wait to see you next year at Ignite ‘23!   Cyber Elite Spotlight Interviews: @PavelK  & @TomYoung    This month we got to know LIVEcommunity Cyber Elite experts @PavelK and @TomYoung via our Spotlight Interview series.   Our Cyber Elite members are among LIVEcommunity's top contributors and we are excited to be featuring them via our community interviews! Read our interviews with these two incredibly active and knowledgeable members now to learn more about who they are, their experience with Palo Alto Networks products, journeys in cybersecurity, and of course, the significance of being a LIVEcommunity Cyber Elite expert.   Pavel, who hails from Czech Republic, started his career as a System Administrator before becoming a Network Engineer and focusing on cybersecurity. He has more than 15 years of IT experience and holds his CCIE, which you can read more about in our Cyber Elite Spotlight Interview with @PavelK.   Tom is a Principal Network Architect and a four-time CCIE/CCDE, PNCSC/PCNSE with more than 20 years of networking/security experience. Read our Cyber Elite Spotlight Interview with @TomYoung now.   New Episodes of PANCast, a Palo Alto Networks Podcast   PANCast, a Palo Alto Networks podcast that provides actionable insights to customers, has two new episodes! Check them out now:   PANCast Episode 6: Understanding Firewall Security Policies     A firewall security policy may seem straight-forward enough, but with its suite of complementary features — appID, userID, URL filtering, SSL decryption, and more — it’s worthwhile to dig into how your policy actually works. Listen to this episode now for a refresher on the importance of security profiles and how Palo Alto Networks’ Best Practice Assessment Tool can help.   PANCast Episode 7: What to Know When Migrating to a Palo Alto Networks Firewall   All devices work differently and engineers might face challenges when migrating from one platform to another. In this episode of PANCast, learn key aspects of firewall migration, how to spot common issues when migrating to a Palo Alto Networks firewall and, more importantly, how to fix them.   New Networking Features with PAN-OS 11.0   Palo Alto Networks launched PAN-OS 11.0 Nova last month, including new advanced features and hardware.   For all the security folk who began their careers in networking, have you seen the new networking features for PAN-OS 11.0? There are many rich features like the PAN-OS integrated web proxy. Customers who require a legacy proxy in their environment can now leverage PAN-OS as a unified platform for maintaining the boundary edge. Check out all of the cool, new networking features for PAN-OS 11.0 Nova in this chart.    Playbook of the Week: Securing the Cloud with Cortex XSOAR and Prisma Cloud The number of risks and threats make securing cloud-based infrastructure, applications, and data extremely critical. Fortunately, Prisma Cloud was designed to secure infrastructure, workloads, and applications, across the entire cloud-native technology stack — throughout the development lifecycle and across hybrid and multi-cloud environments. Read more about Automating Incident Response with the Prisma Cloud content pack.   Palo Alto Networks Introduces Medical IoT Security     Palo Alto Networks has announced a solution for healthcare providers: Medical IoT Security.   In response to the life-threatening attacks on connected healthcare devices, Palo Alto Networks designed a solution purpose-built to protect them. Medical IoT Security, based on the principles of Zero Trust security, provides comprehensive protection for connected medical devices that have exposed healthcare providers to the brunt of cybercriminals’ nefarious attacks. Read more about the benefits of Zero Trust IoT Security from Palo Alto Networks from @msehgal.   Announcing AIOps for NGFW 2.5   Palo Alto Networks is proud to announce the availability of AIOps for NGFW 2.5 and its new features that help customers improve the operational efficiency of managing firewalls. Read the blog to find out about improved Best Practice Assessments, security posture overview, dynamic thresholds and more.   Tips & Tricks: How to Harden Your Admin Access   You wouldn't leave your front door open. So why would you leave your firewall wide open? It can be shocking how many people leave their firewall vulnerable, simply because they never bothered to change the default password.   Check out three simple tips for hardening your admin access from @kiwi now.   Dec ‘22 Discussion Highlight: Posts With Accepted Solutions   Nominated Discussions help LIVEcommunity Solutions Engineers highlight a discussion that has an Accepted Solution, and turn it into an article with additional helpful information, documentation, and clarity! Here are the Nominated Discussions we published this past month:   How to Implement BGP and eBGP on Palo Alto Networks LocalDB User Can't Change Password Update Multiple Categories Within All Security Profiles W/ the CLI   More LIVEcommunity posts published in December:   OWASSRF Vulnerability Exploitation Accessing UID-Agent or AD When Your Management Interface is OOB Automatic Incident Enrichment with XSOAR How to Defend From a Distributed Denial of Service (DDoS) Attack Cortex XSOAR: Why We Automate Processes Find and Fix Your Unknown Risk With Active Attack Surface Management Prisma Access 3.2.1 Update Cloud NGFW for AWS How to Video: Multi-VPC Cloud NGFW resource Introducing the Cortex Help Center Integrate Elasticsearch Into Your Incident Management Playbooks Using XSOAR   You're now fully briefed on LIVEcommunity's December 2022 highlights!   If this was helpful, be sure to give this blog a thumbs up. See you next month! ... View more

As part of our Rapid Breach Response program, the Cortex XSOAR playbook, “CVE-2022-41040 & CVE-2022-41082 - ProxyNotShell,” was updated with more hunting, remediation, and mitigation tasks to identify and respond to exploitation attempts. Cortex XDR customers are protected by the Cortex XDR Agent protected from the payloads deployed by this exploit using the Anti Webshell Protection module and behavioral threat protection.   Download the pack here: CVE-2022-41040 & CVE-2022-41082 - ProxyNotShell   Read the full threat brief from Unit 42: Threat Brief: OWASSRF Vulnerability Exploitation ... View more

Learn how to share the Cloud NGFW resource across multiple VPCs in different AWS accounts in this how-to video from Cloud NGFW experts.   ... View more

  Palo Alto Networks and the Cortex team are pleased to announce the Cortex Help Center is now live!   What is the Cortex Help Center?    The Cortex Help Center is the location for all technical documentation related to the Palo Alto Networks Cortex products. Cortex products include Cortex XSOAR, Cortex XDR, Cortex XDR Agent, Cortex XSIAM, and Cortex Xpanse.   You can search content by product, keyword, and even for specific search terms within documentation (think: a unique product feature, type of alert, or playbook). Watch this short video to learn more about the new Cortex Help Center.       What does this mean for Cortex customers?   This migration of Cortex TechDocs to the Cortex Help Center will not affect your experience in the Customer Support Portal, LIVEcommunity, or community’s Cortex Customer Journey Guides.    Any TechDocs URLs you have saved should seamlessly redirect to content in the Cortex Help Center; this applies to all content linked in the KnowledgeBase, Customer Support Portal, and LIVEcommunity as well. Email us at community@paloaltonetworks.com if you have any issues with TechDocs links from the community.   If you haven't already, bookmark the new Cortex Help Center URL: https://docs-cortex.paloaltonetworks.com.   Thanks for reading! As always, comment down below with any questions or feedback. ... View more

LIVEcommunity's November 2022 Rewind   Welcome to our November 2022 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   There’s a lot to celebrate this month, including the release of PAN-OS 11.0 Nova, the community’s new Member Recognition area, new episodes of the PANCast podcast, discounted tickets for Ignite 2022, and more! Read on to learn about LIVEcommunity’s November 2022 highlights.   Palo Alto Networks Introduces PAN-OS 11.0 Nova   Palo Alto Networks has announced the next wave of innovations with PAN-OS 11.0 Nova. New features include Advanced WildeFire service and Advanced Threat Prevention, enhanced AIOps, Next-Gen CASB and Saas Security Posture Management (SSPM).    The PAN-OS 11.0 Nova release also brings new hardware models. Learn more about how the latest Palo Alto Networks firewalls bring the flexibility of fiber and power over ethernet (PoE) to small branches in this blog from @kiwi on new hardware platform releases.    To learn how you can stay one step ahead of zero-day threats with PAN-OS 11.0 Nova, register for the Launch Event: Stop Zero-Day Malware with Zero Stress. The webinar takes place January 31 and February 1, depending on your timezone.   LIVEcommunity Has a New Member Recognition Area!       We'd like to usher in the holiday season by thanking all of our members and contributors with a new Member Recognition area!   The Member Recognition area features our Cyber Elite Program and Spotlight News. In the Cyber Elite Program area, you’ll find information about each of our Cyber Elite experts, as well as details about the program — including how to become one! In the Spotlight News area, you'll find our Member Spotlight series. Each month, we highlight a member of the community who has been active in posting discussions, making comments, and giving likes.    We hope to soon expand this area to include employees and product experts who are committed to helping customers by sharing important solutions, how-to materials, and tips & tricks with the community.    As we near the end of the year, we want to THANK YOU for being an integral part of our members' success and exemplifying the true meaning of “community.”    November 2022 LIVEcommunity Member Spotlight: @Metgatz     For the November 2022 Member Spotlight, we’d like to applaud one of our community members, @Metgatz, for their participation and engagement in the LIVEcommunity.   Since joining the community in April 2021, they have written 197 posts, received 16 likes, and authored 16 solutions (and counting)!   Thank you for your contribution and participation in the community @Metgatz!    New Episodes of PANCast, a Palo Alto Networks Podcast   PANCast, a Palo Alto Networks podcast that provides actionable insights to customers, has two new episodes! Check them out now:   PANCast Episode 4: Why Is My Dataplane CPU So High? PANCast Episode 5: Why Logs Are Your Best Friend   Ignite '22 Is Just Around the Corner!       We are just weeks away from one of the world's largest digital cybersecurity conferences, Palo Alto Networks' Ignite 2022.   Registration has been open, and we still have a special offer for you: Discounted tickets for LIVEcommunity users! This limited-use code (shown below) will give you a $400 discount off the regular price of $1,699 for the three-day Ignite conference happening in Las Vegas this year! Register today to secure your spot. Use code “IG22_LIVE” to register.   Visit LIVEcommunity's Ignite Event Page to connect and engage with us during the event. Feel free to subscribe to the event page to stay up-to-date and Ignite-related announcements and discussions. (Options > Subscribe)   You can also find specific sessions and further details on the Ignite 2022 schedule. Keep in mind that the Hands-On Labs fill up quickly and we wouldn't want you to miss one of our very own Cyber Elite Experts, @BPry, speaking at the ‘Zero Trust in Practice’ hands-on lab! Join him on Wednesday, December 14, at 4 p.m. PT.   We can’t wait to see you all there!   Playbook of the Week: Malware Investigation and Response - the Sequel   The Malware Investigation and Response Content Pack has key new features we’d like to share with you: After working with customers across various sectors and regions on their deployment of the pack, we incorporated their feedback into a new version of the pack to provide more value without compromising investigation speed or scale.   The new Malware Investigation and Response pack focuses on enhancing capabilities like Account Enrichment, Firewall Enrichment & Validation; Service Level Agreements (SLAs); Microsoft Defender for Endpoint Rate limit handling; and more.   Prisma Cloud Data Security for Azure Is Now Available   We are excited to introduce Azure Blob Storage protection via the Data Security module in Prisma Cloud.    With this addition, Prisma Cloud now offers the following for Azure environments:   Visibility: Provides comprehensive visibility of your storage resources and blobs Exposure analysis: Prevents anonymous public read access for containers and blobs by detecting blob level exposure Sensitive data detection: Identify sensitive and regulatory data such as PII, PHI, customer records, financial records, secrets and intellectual property in your storage blobs  Malware detection: Ensure your storage is free of known and unknown malware, that can spread across your cloud workloads and on-premise infrastructure.   Click the link above to read a few key highlights of features introduced in this release.    Tips & Tricks: Making Sense of Filtered Log Forwarding   Log forwarding has been part of firewalls since, well, the beginning of firewalls. The sheer amount of logging can be intimidating and some challenges can occur. Read this blog by @kiwi on how to leverage PAN-OS log filtering features to save yourself a whole of time and stress!   Cortex XSOAR: Out of the Box vs. Custom Content   Cortex XSOAR is a unique platform in that it enables end-users to create their own custom content. This content includes custom playbooks, indicators, incident types, classification and mapping rules, integrations, automations — the list goes on. The ability to create custom content in Python, PowerShell, or JavaScript that fits specific needs is a huge benefit that XSOAR offers. Learn about the benefits of customizing versus out-of-the-box content in this blog by @ColeLisko.    Threat Brief: CVE-2022-3786 and CVE-2022-3602   On November 1, 2022, OpenSSL released a security advisory describing two high-severity vulnerabilities within the OpenSSL library (CVE-2022-3786 and CVE-2022-3602).   As part of our Rapid Breach Response program, Cortex XSOAR released a new content pack that can help automatically detect and mitigate the detected threats. Learn More & Download the packet here: CVE-2022-3786 & CVE-2022-3602 - OpenSSL X.509 Buffer Overflows    To read the complete threat brief, click here: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows.   Integrating Cortex XSOAR and VirusTotal for Maximum Incident Response and Investigation   Palo Alto Networks Cortex XSOAR works with VirusTotal to help provide context for incidents that analysts are triaging. VirusTotal is an open-source antivirus scanner used to detect malicious files, URLs, and IP addresses. In this blog, we’ll learn how to configure the integration to ensure that VirusTotal is giving XSOAR high fidelity information to act on. Learn what to know, how to integrate, and custom settings in this blog by @ColeLisko.   Nov ‘22 Discussion Highlight: Posts With Accepted Solutions   Nominated Discussions help LIVEcommunity Solutions Engineers highlight a discussion that has an Accepted Solution, and turn it into an article with additional helpful information, documentation, and clarity! Here are the Nominated Discussions we published this past month:   Dual ISP Global Protect Redundancy Understanding Source NAT Address Types Upgrading PAN-OS Versions  How to Block a Specific URL  How to Configure GRE Over IPSEC   More resources that customers might find helpful:   Cortex XDR Pro Vs. MITRE ATT&CK Matrix for Enterprise Shift Left and Increase Your Security Posture  Software Composition Analysis with Code Security IoT Security Update November 2022  5.2.X EoL Extension  Cortex XDR PoC - Malicious Chrome Extensions (customer-only) Cortex XDR & PoC Lab ft.CVE-2021-3560 Review Tips For Safe Online Shopping      You're now fully briefed on LIVEcommunity's November 2022 highlights!   If this was helpful, be sure to give this blog a thumbs up. See you next month!   ... View more

  It’s that time of year again! The most festive period of the year is just around the corner, and people everywhere are going crazy for last-minute bargains.   Online shoppers get ready for Thanksgiving, Black Friday, Cyber Monday, Christmas, and New Year's sales. Now is the time to find those perfect end-of-the-year deals and discounts in the stores and online. It's going to be chaos at the stores, and many people will prefer to do their shopping from the tranquility of their homes.   Many cybercriminals try to take advantage of this increased online activity and prepare scams like social engineering, phishing emails, or spoofed and malicious websites to trick unsuspecting shoppers all over the world.   It's important to stay alert and spot the red flags that could indicate scammers at work. Below, you'll find some tips that can help you be smart and shop safely during the holidays. Safe Shopping Best Practices   Make sure that the software you're using is up-to-date. I'm talking about the OS, browsers, and all the applications you might be using on your end host. This is not limited to your desktop, of course! Since mobile shopping has become more popular, make sure your mobile devices have the latest patches and app versions installed. In doing so, you'll greatly reduce the risk of running into known vulnerabilities and getting infected by malware. Don't use free public wifi for shopping. Using MITM (Man in the Middle) methods, attackers might be listening in on your communication and intercept the traffic. It is best to use a trusted wifi connection like the one at your home. If you aren't at home, then I'd recommend that you turn your smartphone into a hotspot to connect your laptop to the internet. Make sure that your connection is secure. Identify the padlock icon next to the URL.   If it's there, that means that the communication between the client and the server is encrypted. A word of caution: The padlock guarantees privacy between client and server, but it does NOT guarantee that you can trust the website! It might very well be a phishing website designed to trick you into thinking that you are on an "official" website. With that said, make sure that the URL makes sense and isn't some weird wordplay of well known websites. Criminals tend to use fake websites with URLs that are very similar to well known websites. Use credit cards with online transactions, not debit cards. Debit cards aren’t covered by fraud insurance policies and provide direct access to the bank accounts they’re linked to. Credit card companies give insurance to buyers if the product isn’t delivered. Be alert of the information being collected. Make sure you are aware of the kind of information that's being collected when you make an online purchase. If you're being asked for personal data, like Social Security numbers or password information, then that's a definite red flag!  Be wary about pop-ups and ads in general.  While some of them might seem legit, they are often a way for scammers to trick over-enthusiastic online shoppers into clicking them, and then they can redirect you to malicious websites. Be wary of ads that seem too good to be true and just close them or block them out with an ad-blocker. Don't trust every email you get. Phishing emails are used to trick shoppers to go to malicious websites and enter their CC information and/or install all sorts of nasty malware in the process. If you receive a suspicious email from an address you never heard of, with a link to an unknown website, don't open attachments and don't go to the website because it can be malicious. By opening the attachment, you could be installing malware on your device. This is a very popular way that criminals try to steal your information or infect your devices. As in the previous tip, if the deal is too good to be true, then just delete the email.   Avoid unknown websites and only shop on websites that you trust. That new gaming console might look very interesting when it's being offered for $200 cheaper than on other websites. But, at the same time, that shadywebsite.com will be stealing your CC information when you order something from them! Avoid using the same password over and over again.  If one of the websites gets compromised then all of your other accounts are at risk as well. Ideally, use a passphrase. They tend to be easier to remember and are nearly impossible to hack! Still having trouble managing different passwords? Then I'd recommend using a password manager tool to help you with maintaining your passwords. There are many available options out there (e.g., Keepass, LastPass, etc.). Watch out for fake or compromised social media accounts! Fake or compromised social media accounts post links and too-good-to-be-true ads. Just because it's on Facebook or Instagram doesn't mean you can trust it. Do some research and check for reviews! If you are buying on a new website, check for existing reviews. Scammers usually don't have reviews. Look to see if there are other customers that post their experiences with the website. Your movements can be tracked if you have Bluetooth or Wifi enabled.  While you are within range, malicious users can track your location and could possibly verify your shopping habits and send you targeted advertisements. I would advise to disable wifi and bluetooth when you're not using it.   NOTE: This list isn't limited to what I've mentioned above. I'm sure many of you can think of other tips and tricks that could help online shoppers get a much safer online experience!   Don't be shy! Please add your advice in the comments section below.   ... View more