About jforsythe

A retrospective look at the accomplishments and highlights from LIVEcommunity in 2022.   Can you believe another year has come and gone? These past 12 months have no doubt been eventful and we’d like to take a moment to reflect on all that was accomplished.   In 2022, LIVEcommunity made significant improvements. We redesigned our homepage navigation, developed new product pages and customer journey guides, won our first big industry award, published hundreds of helpful blogs and articles, and our members continued to engage in the kind of problem-solving and solution-finding that sets this global community apart.    The LIVEcommunity team appreciates all of those who visited us in 2022, and would like to extend a special thank you to users who provided feedback in the form of comments, mentions, thumbs up/kudos, and replies to posts. We wouldn’t be this vibrant community without each and every one of you!    2022 in LIVEcommunity: By the Numbers   PAGE VIEWS 9,562,584   VISITS 5,242,336    POSTS 21,336   KUDOS GIVEN 6,844   ACCEPTED SOLUTIONS 1,324   LIVEcommunity's Most Popular Blogs From 2022   New Advanced URL Filtering/PANDB Category: Ransomware New Advanced URL Filtering/PANDB Category: Encrypted-DNS Tips & Tricks: How to Ping from the CLI  DOTW: GlobalProtect Virtual Adapter Was Not Set Up Correctly Due to a Delay  Russia-Ukraine Cyber Activity Resources   2022 LIVEcommunity Highlights   LIVEcommunity Won a 2022 Khoros Kudos Award   One of our greatest achievements in 2022 was winning a Khoros Kudos Award. This is the first year LIVEcommunity won a Khoros Kudos award, and we hope it signifies our steadfast commitment to our members and Palo Alto Networks customers around the world.   We Built a New Member Recognition Area!     LIVEcommunity is nothing without its members, which is why we launched a new Member Recognition area earlier this fall.    The Member Recognition area features our Cyber Elite Program and Spotlight News. In the Cyber Elite Program area, you’ll find information about each of our Cyber Elite experts, as well as details about the program (more on that below), while in the Spotlight News area, you'll find our monthly Member Spotlight series which highlights members that have been active in posting discussions, making comments, and giving likes.   LIVEcommunity Welcomed Our 2022-23 Cyber Elite Cohort     ​​The LIVEcommunity team wants to give a shout-out to our 2022 Cyber Elite experts! Cyber Elite experts are highly knowledgeable and engaged members who go above and beyond in their contribution to community.   Earlier this year, we welcomed two new Cyber Elites to this group of super-users, @PavelK and @TomYoung. Thank you to all 11 of our Cyber Elite experts who make this online community as vibrant, helpful, and connected as it is!   PANCast, a Palo Alto Networks Podcast, Launched     Have you listened to PANCast yet? This Palo Alto Networks podcast provides actionable insights from cybersecurity experts to customers; episodes will cover a range of Palo Alto Networks products, offering valuable tips and key information for a successful adoption journey. Check out these episodes from @jarena:    PANCast Episode 1: Four Things You Must Do When Upgrading Your Firewall PANCast Episode 2: How Does GlobalProtect Split Tunneling Work? PANCast Episode 3: URL Filtering — Allowing and Blocking the Right Traffic PANCast Episode 4: Why Is My Dataplane CPU So High? PANCast Episode 5: Why Logs Are Your Best Friend PANCast Episode 6: Understanding Firewall Security Policies PANCast Episode 7: What to Know When Migrating to a Palo Alto Networks Firewall   We Introduced Nominated Discussions for the Community Knowledge Base   LIVEcommunity moderators can now nominate a discussion topic to be an article. This is a great way for members to be able to contribute to our community knowledge base. Here’s a list of our favorite member-posted discussions we turned into articles in 2022:   Palo Alto Free Workshops, Trainings, Trials, and PCNSA/PCNSE Training Global Protect Authentication Happened Two Time While Using RADIUS URL Filtering Profile Set to Allow Ransomware Dual ISP Global Protect Redundancy   Thank you for contributing meaningful topics, replies, and solutions to LIVEcommunity's reservoir of knowledge!   LIVEcommunity Got a New Navigation Bar     Earlier this year, LIVEcommunity updated its homepage navigation! We simplified the navbar and drop-downs in an effort to fine-tune way-finding, organization, and overall user experience. Rather than having blogs, articles, and discussion hidden under Collaboration, these important LIVEcommunity resources now have their own spots in the nav. Products and Tools now have their own drop-downs, where you can hover to find your relevant assets.   Learn all about the changes here.   We Unveiled Cloud NGFW for AWS Help Center       Earlier this spring, Palo Alto Networks announced Cloud NGFW along with Amazon Web Services (AWS). Managed by Palo Alto Networks and easily procured in the AWS Marketplace, the service has been designed to easily deliver our best-in-class security protections with AWS simplicity and scale.   LIVEcommunity’s Cloud NGFW for AWS Help Center page is where you will find FAQs, videos, technical resources, discussions, blogs, and articles related to the deployment and use of Cloud NGFW for AWS. Check it out now.   New Customer Configuration Centers for NGFW and Panorama   In an effort to better serve our customers, LIVEcommunity enabled new, customized configuration help centers for Next-Generation Firewall and Panorama in 2022.   We want our customers to have the tools they need to properly configure, setup, and deploy their products. These new customer configuration areas for NGFW and Panorama are home to key documentation and resources to support your configuration needs. The customer Configuration Centers are available to you every day, all day.   Check them out now: Panorama Customer Configuration Center Next-Generation Firewall Customer Configuration Center    We Created New Technology Pages:   One of our main goals in LIVEcommunity is being home to the newest and most up-to-date resources on Palo Alto Networks technology. This year, we launched a several new technology pages:   Cloud NGFW for AWS Help Center AIOps for NGFW Prisma SD-WAN (including a Customer Journey Guide and Self-Help Resources)  Panorama Customer Configuration Center NGFW Customer Configuration Center Best Practice Assessment Plus (BPA+) Prisma Access for Multi-Tenant Platform (MSPs)   We hope these pages help you in adopting, leveraging, and learning about your Palo Alto Networks product.   As we say goodbye to 2022 and hello to 2023, we want to THANK YOU for being an integral part of our members' success and exemplifying the true meaning of “community.”    LIVEcommunity is Now Available in Chinese In 2022, LIVEcommunity launched a brand new community in Simplified Chinese. You can find it and Japan at the top of our navigation on our homepage.    Thank you to our global community for making 2022 such a successful year. Here's to an even better 2023!   ... View more

December 2022 Rewind: Top posts from LIVEcommunity   Welcome to our December 2022 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   In December, we attended Ignite and connected with some LIVEcommunity members IRL; discussed new networking features in PAN-OS 11.0 Nova with the community; shared new episodes of PANCast, a Palo Alto Networks podcast; and much more. Read on to see what you missed in LIVEcommunity in December, a noteworthy finale to 2022 🎉.   Ignite '22 Recap   Another Ignite conference comes to an end! If you joined us last week in Vegas for Palo Alto Networks annual cybersecurity conference, Ignite 2022, we want to thank you for stopping by the LIVEcommunity booth. If you missed this year's sessions, don’t worry: many of them can be watched on-demand by logging into your account on the Ignite page and clicking on the top right-hand side menu.   The LIVEcommunity team also wants to extend a big thank you to our very own Cyber Elite experts @BPry, @TomYoung, and @MP18 for hanging with us at Ignite. Check them out playing Topgolf with LIVEcommunity manager @crasmussen.    We can’t wait to see you next year at Ignite ‘23!   Cyber Elite Spotlight Interviews: @PavelK  & @TomYoung    This month we got to know LIVEcommunity Cyber Elite experts @PavelK and @TomYoung via our Spotlight Interview series.   Our Cyber Elite members are among LIVEcommunity's top contributors and we are excited to be featuring them via our community interviews! Read our interviews with these two incredibly active and knowledgeable members now to learn more about who they are, their experience with Palo Alto Networks products, journeys in cybersecurity, and of course, the significance of being a LIVEcommunity Cyber Elite expert.   Pavel, who hails from Czech Republic, started his career as a System Administrator before becoming a Network Engineer and focusing on cybersecurity. He has more than 15 years of IT experience and holds his CCIE, which you can read more about in our Cyber Elite Spotlight Interview with @PavelK.   Tom is a Principal Network Architect and a four-time CCIE/CCDE, PNCSC/PCNSE with more than 20 years of networking/security experience. Read our Cyber Elite Spotlight Interview with @TomYoung now.   New Episodes of PANCast, a Palo Alto Networks Podcast   PANCast, a Palo Alto Networks podcast that provides actionable insights to customers, has two new episodes! Check them out now:   PANCast Episode 6: Understanding Firewall Security Policies     A firewall security policy may seem straight-forward enough, but with its suite of complementary features — appID, userID, URL filtering, SSL decryption, and more — it’s worthwhile to dig into how your policy actually works. Listen to this episode now for a refresher on the importance of security profiles and how Palo Alto Networks’ Best Practice Assessment Tool can help.   PANCast Episode 7: What to Know When Migrating to a Palo Alto Networks Firewall   All devices work differently and engineers might face challenges when migrating from one platform to another. In this episode of PANCast, learn key aspects of firewall migration, how to spot common issues when migrating to a Palo Alto Networks firewall and, more importantly, how to fix them.   New Networking Features with PAN-OS 11.0   Palo Alto Networks launched PAN-OS 11.0 Nova last month, including new advanced features and hardware.   For all the security folk who began their careers in networking, have you seen the new networking features for PAN-OS 11.0? There are many rich features like the PAN-OS integrated web proxy. Customers who require a legacy proxy in their environment can now leverage PAN-OS as a unified platform for maintaining the boundary edge. Check out all of the cool, new networking features for PAN-OS 11.0 Nova in this chart.    Playbook of the Week: Securing the Cloud with Cortex XSOAR and Prisma Cloud The number of risks and threats make securing cloud-based infrastructure, applications, and data extremely critical. Fortunately, Prisma Cloud was designed to secure infrastructure, workloads, and applications, across the entire cloud-native technology stack — throughout the development lifecycle and across hybrid and multi-cloud environments. Read more about Automating Incident Response with the Prisma Cloud content pack.   Palo Alto Networks Introduces Medical IoT Security     Palo Alto Networks has announced a solution for healthcare providers: Medical IoT Security.   In response to the life-threatening attacks on connected healthcare devices, Palo Alto Networks designed a solution purpose-built to protect them. Medical IoT Security, based on the principles of Zero Trust security, provides comprehensive protection for connected medical devices that have exposed healthcare providers to the brunt of cybercriminals’ nefarious attacks. Read more about the benefits of Zero Trust IoT Security from Palo Alto Networks from @msehgal.   Announcing AIOps for NGFW 2.5   Palo Alto Networks is proud to announce the availability of AIOps for NGFW 2.5 and its new features that help customers improve the operational efficiency of managing firewalls. Read the blog to find out about improved Best Practice Assessments, security posture overview, dynamic thresholds and more.   Tips & Tricks: How to Harden Your Admin Access   You wouldn't leave your front door open. So why would you leave your firewall wide open? It can be shocking how many people leave their firewall vulnerable, simply because they never bothered to change the default password.   Check out three simple tips for hardening your admin access from @kiwi now.   Dec ‘22 Discussion Highlight: Posts With Accepted Solutions   Nominated Discussions help LIVEcommunity Solutions Engineers highlight a discussion that has an Accepted Solution, and turn it into an article with additional helpful information, documentation, and clarity! Here are the Nominated Discussions we published this past month:   How to Implement BGP and eBGP on Palo Alto Networks LocalDB User Can't Change Password Update Multiple Categories Within All Security Profiles W/ the CLI   More LIVEcommunity posts published in December:   OWASSRF Vulnerability Exploitation Accessing UID-Agent or AD When Your Management Interface is OOB Automatic Incident Enrichment with XSOAR How to Defend From a Distributed Denial of Service (DDoS) Attack Cortex XSOAR: Why We Automate Processes Find and Fix Your Unknown Risk With Active Attack Surface Management Prisma Access 3.2.1 Update Cloud NGFW for AWS How to Video: Multi-VPC Cloud NGFW resource Introducing the Cortex Help Center Integrate Elasticsearch Into Your Incident Management Playbooks Using XSOAR   You're now fully briefed on LIVEcommunity's December 2022 highlights!   If this was helpful, be sure to give this blog a thumbs up. See you next month! ... View more

As part of our Rapid Breach Response program, the Cortex XSOAR playbook, “CVE-2022-41040 & CVE-2022-41082 - ProxyNotShell,” was updated with more hunting, remediation, and mitigation tasks to identify and respond to exploitation attempts. Cortex XDR customers are protected by the Cortex XDR Agent protected from the payloads deployed by this exploit using the Anti Webshell Protection module and behavioral threat protection.   Download the pack here: CVE-2022-41040 & CVE-2022-41082 - ProxyNotShell   Read the full threat brief from Unit 42: Threat Brief: OWASSRF Vulnerability Exploitation ... View more

Learn how to share the Cloud NGFW resource across multiple VPCs in different AWS accounts in this how-to video from Cloud NGFW experts.   ... View more

  Palo Alto Networks and the Cortex team are pleased to announce the Cortex Help Center is now live!   What is the Cortex Help Center?    The Cortex Help Center is the location for all technical documentation related to the Palo Alto Networks Cortex products. Cortex products include Cortex XSOAR, Cortex XDR, Cortex XDR Agent, Cortex XSIAM, and Cortex Xpanse.   You can search content by product, keyword, and even for specific search terms within documentation (think: a unique product feature, type of alert, or playbook). Watch this short video to learn more about the new Cortex Help Center.       What does this mean for Cortex customers?   This migration of Cortex TechDocs to the Cortex Help Center will not affect your experience in the Customer Support Portal, LIVEcommunity, or community’s Cortex Customer Journey Guides.    Any TechDocs URLs you have saved should seamlessly redirect to content in the Cortex Help Center; this applies to all content linked in the KnowledgeBase, Customer Support Portal, and LIVEcommunity as well. Email us at community@paloaltonetworks.com if you have any issues with TechDocs links from the community.   If you haven't already, bookmark the new Cortex Help Center URL: https://docs-cortex.paloaltonetworks.com.   Thanks for reading! As always, comment down below with any questions or feedback. ... View more

LIVEcommunity's November 2022 Rewind   Welcome to our November 2022 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   There’s a lot to celebrate this month, including the release of PAN-OS 11.0 Nova, the community’s new Member Recognition area, new episodes of the PANCast podcast, discounted tickets for Ignite 2022, and more! Read on to learn about LIVEcommunity’s November 2022 highlights.   Palo Alto Networks Introduces PAN-OS 11.0 Nova   Palo Alto Networks has announced the next wave of innovations with PAN-OS 11.0 Nova. New features include Advanced WildeFire service and Advanced Threat Prevention, enhanced AIOps, Next-Gen CASB and Saas Security Posture Management (SSPM).    The PAN-OS 11.0 Nova release also brings new hardware models. Learn more about how the latest Palo Alto Networks firewalls bring the flexibility of fiber and power over ethernet (PoE) to small branches in this blog from @kiwi on new hardware platform releases.    To learn how you can stay one step ahead of zero-day threats with PAN-OS 11.0 Nova, register for the Launch Event: Stop Zero-Day Malware with Zero Stress. The webinar takes place January 31 and February 1, depending on your timezone.   LIVEcommunity Has a New Member Recognition Area!       We'd like to usher in the holiday season by thanking all of our members and contributors with a new Member Recognition area!   The Member Recognition area features our Cyber Elite Program and Spotlight News. In the Cyber Elite Program area, you’ll find information about each of our Cyber Elite experts, as well as details about the program — including how to become one! In the Spotlight News area, you'll find our Member Spotlight series. Each month, we highlight a member of the community who has been active in posting discussions, making comments, and giving likes.    We hope to soon expand this area to include employees and product experts who are committed to helping customers by sharing important solutions, how-to materials, and tips & tricks with the community.    As we near the end of the year, we want to THANK YOU for being an integral part of our members' success and exemplifying the true meaning of “community.”    November 2022 LIVEcommunity Member Spotlight: @Metgatz     For the November 2022 Member Spotlight, we’d like to applaud one of our community members, @Metgatz, for their participation and engagement in the LIVEcommunity.   Since joining the community in April 2021, they have written 197 posts, received 16 likes, and authored 16 solutions (and counting)!   Thank you for your contribution and participation in the community @Metgatz!    New Episodes of PANCast, a Palo Alto Networks Podcast   PANCast, a Palo Alto Networks podcast that provides actionable insights to customers, has two new episodes! Check them out now:   PANCast Episode 4: Why Is My Dataplane CPU So High? PANCast Episode 5: Why Logs Are Your Best Friend   Ignite '22 Is Just Around the Corner!       We are just weeks away from one of the world's largest digital cybersecurity conferences, Palo Alto Networks' Ignite 2022.   Registration has been open, and we still have a special offer for you: Discounted tickets for LIVEcommunity users! This limited-use code (shown below) will give you a $400 discount off the regular price of $1,699 for the three-day Ignite conference happening in Las Vegas this year! Register today to secure your spot. Use code “IG22_LIVE” to register.   Visit LIVEcommunity's Ignite Event Page to connect and engage with us during the event. Feel free to subscribe to the event page to stay up-to-date and Ignite-related announcements and discussions. (Options > Subscribe)   You can also find specific sessions and further details on the Ignite 2022 schedule. Keep in mind that the Hands-On Labs fill up quickly and we wouldn't want you to miss one of our very own Cyber Elite Experts, @BPry, speaking at the ‘Zero Trust in Practice’ hands-on lab! Join him on Wednesday, December 14, at 4 p.m. PT.   We can’t wait to see you all there!   Playbook of the Week: Malware Investigation and Response - the Sequel   The Malware Investigation and Response Content Pack has key new features we’d like to share with you: After working with customers across various sectors and regions on their deployment of the pack, we incorporated their feedback into a new version of the pack to provide more value without compromising investigation speed or scale.   The new Malware Investigation and Response pack focuses on enhancing capabilities like Account Enrichment, Firewall Enrichment & Validation; Service Level Agreements (SLAs); Microsoft Defender for Endpoint Rate limit handling; and more.   Prisma Cloud Data Security for Azure Is Now Available   We are excited to introduce Azure Blob Storage protection via the Data Security module in Prisma Cloud.    With this addition, Prisma Cloud now offers the following for Azure environments:   Visibility: Provides comprehensive visibility of your storage resources and blobs Exposure analysis: Prevents anonymous public read access for containers and blobs by detecting blob level exposure Sensitive data detection: Identify sensitive and regulatory data such as PII, PHI, customer records, financial records, secrets and intellectual property in your storage blobs  Malware detection: Ensure your storage is free of known and unknown malware, that can spread across your cloud workloads and on-premise infrastructure.   Click the link above to read a few key highlights of features introduced in this release.    Tips & Tricks: Making Sense of Filtered Log Forwarding   Log forwarding has been part of firewalls since, well, the beginning of firewalls. The sheer amount of logging can be intimidating and some challenges can occur. Read this blog by @kiwi on how to leverage PAN-OS log filtering features to save yourself a whole of time and stress!   Cortex XSOAR: Out of the Box vs. Custom Content   Cortex XSOAR is a unique platform in that it enables end-users to create their own custom content. This content includes custom playbooks, indicators, incident types, classification and mapping rules, integrations, automations — the list goes on. The ability to create custom content in Python, PowerShell, or JavaScript that fits specific needs is a huge benefit that XSOAR offers. Learn about the benefits of customizing versus out-of-the-box content in this blog by @ColeLisko.    Threat Brief: CVE-2022-3786 and CVE-2022-3602   On November 1, 2022, OpenSSL released a security advisory describing two high-severity vulnerabilities within the OpenSSL library (CVE-2022-3786 and CVE-2022-3602).   As part of our Rapid Breach Response program, Cortex XSOAR released a new content pack that can help automatically detect and mitigate the detected threats. Learn More & Download the packet here: CVE-2022-3786 & CVE-2022-3602 - OpenSSL X.509 Buffer Overflows    To read the complete threat brief, click here: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows.   Integrating Cortex XSOAR and VirusTotal for Maximum Incident Response and Investigation   Palo Alto Networks Cortex XSOAR works with VirusTotal to help provide context for incidents that analysts are triaging. VirusTotal is an open-source antivirus scanner used to detect malicious files, URLs, and IP addresses. In this blog, we’ll learn how to configure the integration to ensure that VirusTotal is giving XSOAR high fidelity information to act on. Learn what to know, how to integrate, and custom settings in this blog by @ColeLisko.   Nov ‘22 Discussion Highlight: Posts With Accepted Solutions   Nominated Discussions help LIVEcommunity Solutions Engineers highlight a discussion that has an Accepted Solution, and turn it into an article with additional helpful information, documentation, and clarity! Here are the Nominated Discussions we published this past month:   Dual ISP Global Protect Redundancy Understanding Source NAT Address Types Upgrading PAN-OS Versions  How to Block a Specific URL  How to Configure GRE Over IPSEC   More resources that customers might find helpful:   Cortex XDR Pro Vs. MITRE ATT&CK Matrix for Enterprise Shift Left and Increase Your Security Posture  Software Composition Analysis with Code Security IoT Security Update November 2022  5.2.X EoL Extension  Cortex XDR PoC - Malicious Chrome Extensions (customer-only) Cortex XDR & PoC Lab ft.CVE-2021-3560 Review Tips For Safe Online Shopping      You're now fully briefed on LIVEcommunity's November 2022 highlights!   If this was helpful, be sure to give this blog a thumbs up. See you next month!   ... View more

  It’s that time of year again! The most festive period of the year is just around the corner, and people everywhere are going crazy for last-minute bargains.   Online shoppers get ready for Thanksgiving, Black Friday, Cyber Monday, Christmas, and New Year's sales. Now is the time to find those perfect end-of-the-year deals and discounts in the stores and online. It's going to be chaos at the stores, and many people will prefer to do their shopping from the tranquility of their homes.   Many cybercriminals try to take advantage of this increased online activity and prepare scams like social engineering, phishing emails, or spoofed and malicious websites to trick unsuspecting shoppers all over the world.   It's important to stay alert and spot the red flags that could indicate scammers at work. Below, you'll find some tips that can help you be smart and shop safely during the holidays. Safe Shopping Best Practices   Make sure that the software you're using is up-to-date. I'm talking about the OS, browsers, and all the applications you might be using on your end host. This is not limited to your desktop, of course! Since mobile shopping has become more popular, make sure your mobile devices have the latest patches and app versions installed. In doing so, you'll greatly reduce the risk of running into known vulnerabilities and getting infected by malware. Don't use free public wifi for shopping. Using MITM (Man in the Middle) methods, attackers might be listening in on your communication and intercept the traffic. It is best to use a trusted wifi connection like the one at your home. If you aren't at home, then I'd recommend that you turn your smartphone into a hotspot to connect your laptop to the internet. Make sure that your connection is secure. Identify the padlock icon next to the URL.   If it's there, that means that the communication between the client and the server is encrypted. A word of caution: The padlock guarantees privacy between client and server, but it does NOT guarantee that you can trust the website! It might very well be a phishing website designed to trick you into thinking that you are on an "official" website. With that said, make sure that the URL makes sense and isn't some weird wordplay of well known websites. Criminals tend to use fake websites with URLs that are very similar to well known websites. Use credit cards with online transactions, not debit cards. Debit cards aren’t covered by fraud insurance policies and provide direct access to the bank accounts they’re linked to. Credit card companies give insurance to buyers if the product isn’t delivered. Be alert of the information being collected. Make sure you are aware of the kind of information that's being collected when you make an online purchase. If you're being asked for personal data, like Social Security numbers or password information, then that's a definite red flag!  Be wary about pop-ups and ads in general.  While some of them might seem legit, they are often a way for scammers to trick over-enthusiastic online shoppers into clicking them, and then they can redirect you to malicious websites. Be wary of ads that seem too good to be true and just close them or block them out with an ad-blocker. Don't trust every email you get. Phishing emails are used to trick shoppers to go to malicious websites and enter their CC information and/or install all sorts of nasty malware in the process. If you receive a suspicious email from an address you never heard of, with a link to an unknown website, don't open attachments and don't go to the website because it can be malicious. By opening the attachment, you could be installing malware on your device. This is a very popular way that criminals try to steal your information or infect your devices. As in the previous tip, if the deal is too good to be true, then just delete the email.   Avoid unknown websites and only shop on websites that you trust. That new gaming console might look very interesting when it's being offered for $200 cheaper than on other websites. But, at the same time, that shadywebsite.com will be stealing your CC information when you order something from them! Avoid using the same password over and over again.  If one of the websites gets compromised then all of your other accounts are at risk as well. Ideally, use a passphrase. They tend to be easier to remember and are nearly impossible to hack! Still having trouble managing different passwords? Then I'd recommend using a password manager tool to help you with maintaining your passwords. There are many available options out there (e.g., Keepass, LastPass, etc.). Watch out for fake or compromised social media accounts! Fake or compromised social media accounts post links and too-good-to-be-true ads. Just because it's on Facebook or Instagram doesn't mean you can trust it. Do some research and check for reviews! If you are buying on a new website, check for existing reviews. Scammers usually don't have reviews. Look to see if there are other customers that post their experiences with the website. Your movements can be tracked if you have Bluetooth or Wifi enabled.  While you are within range, malicious users can track your location and could possibly verify your shopping habits and send you targeted advertisements. I would advise to disable wifi and bluetooth when you're not using it.   NOTE: This list isn't limited to what I've mentioned above. I'm sure many of you can think of other tips and tricks that could help online shoppers get a much safer online experience!   Don't be shy! Please add your advice in the comments section below.   ... View more

  By Bar Katzir, Product Manager for Cortex, and Sasha Sokolovich, Security Architect for Cortex   Enhancing your security automation and response capabilities across multiple platforms while tending to large amounts of threat investigations is anything but easy. But not doing so requires dependency on many manual processes, increasing incident investigation time and overall risk of malware infections. To prepare for the next inevitable attack, SOC teams must continuously look for ways to improve their post-incident activity processes.   Figure 1: NIST Incident Lifecycle process     You don’t need to do it yourself. Let automation help.   Streamline and automate the malware investigation process with Cortex XSOAR’s Malware Investigation and Response pack. Released in June 2022, the Malware Investigation & Response pack accelerates the investigation process for endpoint malware incidents and alerts by collecting evidence of malicious behaviors, searching telemetry data available through EDRs, and processing malware analysis reports through sandboxes. Incident layouts also include buttons to quickly trigger containment activities. Customers like you have found immense value in the Malware Investigation and Response Pack, alongside the Deployment Wizard, since its release.   To quote an EMEA Financial Services customer:   “The Malware Investigation and Response pack is by far the easiest use case to deploy.”   Key New Features of the Malware Investigation and Response Content Pack   After working with customers across various sectors and regions on their deployment of the pack, we incorporated their feedback into a new version of the pack to provide more value without compromising investigation speed or scale.   For the new Malware Investigation and Response pack, we focused on the following capabilities:   Account Enrichment   Incorporating the capability to retrieve information about the active user on the endpoint will give the analyst context about the endpoint and possible risks to the organization.   For example, providing insight into the active user’s department— whether they are in finance or engineering— enables the analyst to disable the user's account in the corresponding IDP as needed.   Figure 2: Account Information details in incident view   Firewall Enrichment & Validation (with Threat Hunting Generic playbook)   SIEM and newly added Network Security tools give more context to the threats in your organization. This provides valuable context regarding the severity of the  threat and how wide it has spread within your organization.   Joe Security Sandbox coverage   The new integration with Joe Security sandbox allows analysts to retrieve submitted file information or automatically detonate files that are detected by the deployed EDR. The retrieved information allows the analyst to gain more insights on the alert by using the Sandbox analysis full report or even a quick view of the extracted IOCs, such as MITRE ATT&CK information, from the layout itself.   Figure 3: Joe Security Sandbox Report available to analyst for incident investigation       Figure 4: Joe Security Sandbox Report providing rich analysis and MITRE ATT&CK mapping   Addition of Service Level Agreements (SLAs)   Security investigations are time-sensitive. The longer before the threat is contained, the greater the risk of exposure to the organization. With this enhancement of the pack, you can easily track and monitor Triage, Remediation, and Containment SLAs.     Figure 5: SLAs section within the incident   An SLA Dashboard also allows you to quickly filter your Incident Types based on Severity so you can properly diagnose your SLAs.     Figure 6: SLA Dashboard Microsoft Defender for Endpoint Rate limit handling   Some advanced hunting queries have limitations. However, the Cortex XSOAR Malware Investigation and Response v2 content pack includes a baked-in rate-limiting support mechanism, which will re-run your queries in the playbooks if you have reached your Incidents API or Advanced Hunting API quota. This ensures your investigation goes unhindered.   Microsoft Defender for Endpoint Advanced Hunting Batch Queries   As the XSOAR R&D team keeps evolving and maintaining current playbooks, it is essential to have flexibility when it comes to customization. This feature allows the customer to add a batch of pre-defined queries as a playbook input. This way, there is no need to detach the playbook for adding your custom Microsoft Defender Advanced Hunting queries.   Assign Analyst to an Incident   Assigning an analyst to an incident based on the less busy user is now available. Moreover, you may define if you would like to assign an on-call analyst using the playbook inputs.   Continuous Innovation in Automation   The Malware Investigation and Response pack accelerates the investigation process for cybersecurity analysts and makes containment activities push-button simple. Although the latest additions add a ton of value for our customers, we are already thinking about what’s next.     For more information on the Malware Investigation and Response Pack and other XSOAR packs and playbooks, visit our Cortex XSOAR Developer Docs reference page.   Don’t have Cortex XSOAR? Download our free Community Edition today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.   ... View more

October 2022 LIVEcommunity Rewind   Welcome to our October 2022 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   In October, we recap new episodes of PANCast, a Palo Alto Networks podcast; Cortex XSIAM, Palo Alto Networks’ new autonomous platform powering the modern SOC; new webinars and more! Read on to learn about LIVEcommunity’s October 2022 highlights.   XSIAM Has Arrived to Revolutionize the SOC     We believe that the only way a SOC platform can operate at today’s scale is to completely rebuild from the ground up. So we’ve done exactly that with XSIAM, the autonomous security operations platform designed to enable all customers to achieve the outcomes Palo Alto Networks does in our own SOC. How? It all comes down to data that drives analytics, automation and proactivity. Read more about it in the blog from Lee Klarich, Palo Alto Networks Chief Product Officer, “XSIAM Has Arrived to Revolutionize the SOC.”   Register now for the The Modern SOC, Reimagined, a virtual event happening November 2, 2022.   New Episodes of PANCast, a Palo Alto Networks Podcast     Have you listened to PANCast yet? This new Palo Alto Networks podcast provides actionable insights from cybersecurity experts to customers; episodes will cover a range of Palo Alto Networks products, offering valuable tips and key information for a successful adoption journey. Check out the newest episodes from @jarena:    PANCast Episode 2: How Does GlobalProtect Split Tunneling Work? PANCast Episode 3: URL Filtering — Allowing and Blocking the Right Traffic   Playbook of the Week: Teaching XSOAR a Few New Tricks with Slack Blocks   In most cases, SlackAsk does not provide enough information suitable for analyst investigations, as it focuses mainly on binary “yes/no” questions. It has become fairly common for SOC engineers to use the SlackV3 content pack purely as a notification utility, but you shouldn’t have to be a Slack power user to utilize all that Slack blocks are capable of providing.    The Slack V3 content pack allows you to interact with the Slack API by collecting logs and sending messages and notifications to your Slack team. It integrates with Slack's services to investigate failed login events and execute, create, read, update, and delete operations for employee lifecycle processes.   New AIOps Feature: On-Demand BPA   You can now run a best practice assessment (BPA) directly in AIOps for NGFW by uploading a Tech Support File (TSF). Now, you can generate an on-demand BPA report for devices that are not sending telemetry data or are not onboarded to AIOps (e.g. PAN-OS 9.1 devices), as well as devices that are onboarded to AIOps for NGFW with telemetry enabled.   Cortex XDR How-to Videos Learn about a common use case for Endpoint Administration Cleanup, how Cortex XDR can ingest Windows DHCP logs to discover additional network devices; and how to use object data from Active Directory to create endpoint groups which can be used for policy targeting in the latest Cortex XDR how-to videos!   Cortex XDR How-To Video: Endpoint Group Cortex XDR How-To Video: Configure Cloud Identity Agent Cortex XDR How-To Video: Windows DHCP Log Ingestion   What's New: IoT Security, October '22 Update   In the October what’s in IoT Security update, we learned about a new third-party integration with BlueCat IPAM — which expands visibility into the structure and organization of the IP address—improvements to appearance and behavior, and a new report from RHISAC on the latest cyber threats from the retail, hospitality, and travel sectors.    Two New Posts Written By Cyber Elite Expert @Nikoolayy1   Cyber Elite Expert @Nikoolayy1 wrote two super-helpful posts for LIVEcommunity this month! Check ‘em out:   OCR for Enterprise DLP and SaaS Security API  Optical Character Recognition or Optical Character reader (OCR), which is the electronic or mechanical conversion of images of typed, handwritten or printed text into machine-encoded text. This new feature is configured in Enterprise DLP cloud portal and functions for Prisma Access or on-prem firewalls with the Panorama Plug-in.    XDR Isolation Exceptions and Exclusions Use Case When you isolate an endpoint, you halt all endpoint network access — except for traffic to #Cortex XDR. This can prevent a compromised endpoint from communicating with other endpoints, which reduces an attacker’s mobility. But traffic to Cortex XDR can be halted while still ensuring communication to Cortex XDR is always allowed.   Tips & Tricks: How to Get Updates From the Internet Without Internet Access       Did you know that you can avoid messy work-arounds for not having internet access with Service Routes. This cool feature makes certain services use a dataplane interface (instead of the management interface). Special shoutout to Cyber Elite @reaper for his contribution to this blog!    October 2022 LIVEcommunity Member Spotlight: @LAYER_8   For the October 2022 Member Spotlight, we’d like to applaud one of our community members, @LAYER_8, for their participation and engagement in the LIVEcommunity!    Since joining the community in July 2014, they have written 293 posts, received 79 likes, and authored 32 solutions (and counting). Thank you for your contribution and participation in the community @LAYER_8!   VM-Series Virtual Firewalls Integrate with Azure Gateway Load Balancer   Palo Alto Networks is pleased to announce the General Availability of integration of VM-Series virtual firewalls with Microsoft Azure Gateway Load Balancer. This integration has been designed to efficiently augment native Microsoft Azure network security capabilities with next-generation threat protection — so customers can more easily attain greater performance and scalability.    Tips & Tricks: Block High-Risk Apps with Application Filters   Often overlooked, Application Filter objects can be a useful tool for administrators to streamline the security policy rulebase. An Application Filter is a dynamic object that can be created based on administrator-defined application attributes, including category, subcategory, risk factor, tags, and characteristics. Read more in this blog by @JayGolf — again with help from Cyber Elite expert @reaper! 🎉   Prisma Cloud Code Security and Drift Detection   Drift Detection is a feature that is included with Prisma Cloud Code Security that helps detect unwanted changes to your project’s source code. A few lines of code can turn your project upside down by creating easy entry points for hackers to use in order to leak data or turn your repository into malware.   If you already have a Prisma Cloud Code Security subscription, you can learn how to set up Drift Detection for your repositories now. Otherwise, read this blog on Prisma Cloud and Drift Detection to learn about how Drift Detection can help you maintain your security posture.   URL Filtering: Assigning Multiple Categories to URLs   Did you know that Palo Alto Networks URL filtering can assign multiple categories to URLs that classify a website’s content, purpose, and safety? Every URL can have up to four categories, including a security-focused URL category (or "risk category" for short) that indicates how likely it is that the site will expose you to threats.   These risk categories enable you to implement simple security and decryption policies based on website safety, without requiring you to research and individually assess the sites that are likely to expose you to web-based threats.   This Month’s Nominated Discussions With Accepted Solutions   Nominated Discussions help LIVEcommunity Solutions Engineers highlight a discussion post that has an Accepted Solution, and turn it into an article with additional helpful information, documentation, and clarity. Here are the Nominated Discussions we published this past month:   Multiple ISPs with Path Monitoring URL Filtering Profile Set to Allow Ransomware Global Protect Authentication Happened Two Time While Using RADIUS   You're now fully briefed on LIVEcommunity's October 2022 highlights!   If this was helpful, be sure to give this blog a thumbs up. See you next month!   ... View more

Welcome to our September 2022 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month.   In September, LIVEcommunity won a community platform award, launched a new Palo Alto Networks podcast, announced our new Cyber Elite experts, and more. Read on to learn about LIVEcommunity’s September 2022 highlights 🥳.   LIVEcommunity Wins a 2022 Khoros Kudos Award   The LIVEcommunity team is pleased to announce that our community has been recognized with a 2022 Khoros Kudos Award.    This is the first time LIVEcommunity has participated in the annual Khoros Kudos Awards, and we’d like to thank our members for making this the vital, vibrant, and valuable community that it is! Our priority is to continue helping our customers make the most of Palo Alto Networks products and services.   Introducing PANCast, A New Palo Alto Networks Podcast       Palo Alto Networks has a new podcast! PANCast provides actionable insights from the experiences of cybersecurity experts to Palo Alto Networks customers in short episodes — helping you ensure each day is more secure than the one before.    Check out the pilot episode above, and find new episodes on the LIVEcommunity PANCast page as well as our PANCast YouTube playlist.    Join Us in Welcoming Our 2022 Cyber Elite Experts   On National IT Professionals Day — September 20 — we announced our 2022-23 cohort of Cyber Elite experts! These members make up a small but robust team of super-users who are eager to help, supply solutions, and troubleshoot with their fellow cybersecurity professionals looking for answers in LIVEcommunity.   Read more about the program and meet the Cyber Elite crew here.   Ignite ‘22 Registration is Now Open!     Registration is officially open for Palo Alto Networks’ Ignite ‘22 conference — and LIVEcommunity users get a special discount! Use code "IG22_LIVE" to register now and get a $400 discount to attend one of the industry’s top conferences, happening in Las Vegas in December.    September 2022 LIVEcommunity Member Spotlight: @JimmyHolland     We’d like to applaud @JimmyHolland for their participation and engagement in the LIVEcommunity. Since joining the community in July 2014, they have written 226 posts, received 64 likes, and authored 35 solutions! Thank you for being one of our valued members, @JimmyHolland.   You Can Now Watch SASE Converge 2022 On-Demand   It's not too late to hear from Palo Alto Networks leadership and industry experts talk about the latest trends and innovations in SASE: Watch SASE Converge 2022 on-demand now.   GlobalProtect 6.1: New Features and Behavior   GlobalProtect enables organizations to protect the mobile workforce by extending the next-generation security platform to all users, regardless of location. Read @kiwi’s blog to learn about all the new features and behavior introduced with the release of GlobalProtect 6.1.   AIOps for NGFW New Features and Enhancements Update: September 2022   We’re proud to announce the availability of AIOps for NGFW 2.0 to help customers improve the efficiency, health, performance and maximize their security posture. This release includes new features, such as increased ability to visualize and report the interplay between users, applications and threats across their entire deployment.   Here are some key features part of the AIOps for NGFW 2.0 release.   AutoFocus End-of-Sale FAQ and Alternatives   Palo Alto Networks is announcing End-of-Sale for its AutoFocus product on September 30, 2022. Find out what the EOL means for you and Palo Alto Networks' suggested alternatives for the cloud-based threat intelligence service.   New Advanced URL Filtering/PANDB Category: Encrypted-DNS   Palo Alto Networks is releasing a new category called “Encrypted-DNS” under Advanced URL Filtering. Find out what the new category does, what actions are required and recommended, and others Encrytped-DNS FAQs.   Tips & Tricks: How to Create Custom Reports in PAN-OS   PAN-OS has a set of helpful, predefined reports that allow traffic visibility in the network. The reports, scheduled and generated by default, save the administrator from configuring custom reports. Find out how to create custom reports in PAN-OS in @kiwi's blog.    Using NGFW to Prevent Corporate Credential Theft   The popularity of cryptocurrency has skyrocketed over the last few years and its use is no longer limited to technology enthusiasts. The growing success of digital assets like Bitcoin and Ethereum has ushered in a new era for cybercrime with Cryptocurrency firms being the target of advanced attacks. A financial services firm hired Unit 42 to investigate an attack by the North Korea-backed Lazarus Group. Find out how you can avoid corporate credential theft in @JayGolf's post on using NGFW to prevent corporate credential theft.   LIVEcommunity’s Forum Highlight Reel: Nominated Discussions   Did you know that LIVEcommunity has a new feature called Nominated Discussions? This function is a key way for LIVEcommunity Solutions Engineers to highlight a discussion post that has an Accepted Solution, and turn it into an article with additional helpful information, documentation, and clarity. Here are some Nominated Discussions from September 2022:   What Does the “No Direct Access to Local Network” Setting Do? Best Guides for New Firewall Deployment Dynamically Update Microsoft Office URLs and IPs Warning Certificate Chain Not Correctly Formed in Certificate DUAL ISP Configurations App-ID Windows Remote Management Showing Up As Web-Browsing How to Send Maintenance Messages in GlobalProtect Client Syslog Forwarding Issue     You're now fully briefed on LIVEcommunity's September 2022 highlights! Thank you for reading.   If this was helpful, be sure to give this blog a thumbs up. See you next month! ... View more

The LIVEcommunity team is pleased to announce that our community has been recognized with a 2022 Khoros Kudos Award!   Our priority is to provide you — our 200,000+ members — everything you need to make the most of your products and services. LIVEcommunity is a collaborative online community, where cybersecurity and IT professionals come together from around the world to find solutions through countless discussions, step-by-step customer journey guides, technical documentation and key resources. We blend powerful technologies, compelling content and feature-rich experiences to bring self-help resources and peer-to-peer engagement at your fingertips.   This is the first time LIVEcommunity has participated in the annual Khoros Kudos Awards! We are honored to be recognized as a  Partner for Life, which selects the top company that “has taken advantage of Khoros’ experience in innovation and partnership to align people, processes and technology to better connect with their customers in all ways.”    “LIVEcommunity gives us the tools to serve our global members,” says Cheryl Rasmussen, LIVEcommunity manager. “The peer-to-peer connections, collaboration and valuable insights help our customers create a more secure digital space for all.”    The relationship between LIVEcommunity and Khoros can be illustrated by some important highlights from this past year, like our Customer Experience (CX) refresh—which provided a simplified user experience, enhanced self-service support, and increased engagement—and the implementation of useful tools, like Palo Alto Networks-approved and expert-approved discussion post icons; an events page; and a product catalog to enhance content organization and search optimization.    Thank you to all of our members and contributors for making LIVEcommunity possible!   LIVEcommunity — proving that thousands of minds working together are far more powerful than a lone engineer. ... View more