About mikand

Perhaps one of the solutions explained in How can I remove specific events from the event log in Windows Server 2008? - Server Fault might help? " If you want to find actual problems and you have specific event ID's that you don't care to weed through, create a custom view with the following steps ... In your event log click on "Filter Current Log" in the action pane. About half way down the dialog box that pops up, you will find a text box with Replace this text with your filter needs. If you want only a certain event, put that event ID in there. If you have multiples, use commas to separate. If you wish to exclude, use a minus sign. In this case we would use "-1111" (without the quotes of course). Click "OK" on the dialog box. In the action pane you now click "Save Filter to Custom View". Now when you wish to look at your event log, use your custom view and only the information you are truly concerned with will be displayed. " " What might solve your problem is to change the audit policies in group policy. Without knowing what specifically you want to not show up, I'm not sure if there's a setting for it, but here's an example. In GPMC, drill down through Computer Configuration - Windows Settings - Security Settings - Local Policies - Audit Policy. There's not a TON of granularity here, but maybe you can get rid of what's filling up your logs. (My DCs aren't 2008, so this is what I've got from a 2003 AD perspective, hopefully it's not completely different) " ... View more

I cant find anything right now about shamoon in https://threatvault.paloaltonetworks.com/ searching for vuln, spyware and virus (dont forget to change that dropdown to the right). However plenty of flame variants when searching for flame in the virus container along with two generic signatures in spyware. Perhaps shamoon is already covered by one of the flame variants? Tricky part of all these names is that the AV community tends to create their own name for each virus which means something that Kaspersky has named could be the very same thing but different name when looking in Symantec db's and so on. ... View more

As far as I know PA doesnt support loadbalancing based on content (for that purpose use F5 or similar devices which you can place behind a PA). So in your case you have to either: 1) Server A gets publicip:TCP80, Server B gets publicip:TCP81 (or whatever port you want to use). or 2) Server A gets publicip1:TCP80, Server B gets publicip2:TCP80. ... View more

Setup a QoS profile and assign it to whichever interface(s) you like. However im not sure if QoS is suitable to use in vwire situations. ... View more

To block the subnet the correct way is to block at dstip and not dsturl. However even if a real browser shouldnt be able to connect to a different ip than the one stated in the url request (I mean if you type http://5.6.7.8/ in your browser the browser will try to connect to dstip 5.6.7.8) there could be various malwares and possible other cases of where http is being used as a protocol but where the dstip is for example 1.2.3.4 but the requested url is http://5.6.7.8/ for a particular request (or "Host: 5.6.7.8" for that matter). A question related to this, does PA have a IPS-signature against if a client performs a request towards dstip 1.2.3.4 but the url requested is http://5.6.7.8/ (or rather "Host: 5.6.7.8") and is this signature valid for both IPv4 and IPv6? ... View more

When setting up a pan-agent for use of user-id feature in PA the pan-agent will need to tail the security log of all your DC's (Domain Controller). You will instruct it which ip addresses your DC's have (along with which iprange(s) you want to monitor). The eventids which are being monitored are: Windows 2003 DC: - 672 (Authentication  Ticket Granted, which occurs on the logon moment) - 673 (Service Ticket Granted) - 674 (Ticket Granted Renewed which may happen several times during the logon session) Windows 2008 DC: - 4768 (Authentication Ticket Granted) - 4769 (Service Ticket Granted) - 4770 (Ticket Granted Renewed)  In addition to the above you can also monitor activity to any file, print or exchange server (which will give info of username <> ipaddress relations). In your case I think someone has setup netbios/wmi probing of clients to improve the userid function. Usually netbios is not recommended while wmi is the recommended way to do this in case you need it. The netbios/wmi probing of clients is an active way of the pan-agent to verify that each ip address still have the logged user logged in on the device (because the above DC security log tailing and file,print,exchange server activity are all "passive" methods of detecting who is behind each ip address). Check out this doc for more information: ... View more

Sounds like PBF (Policy Based Forwarding) could be the solution for your case: This way you can setup so (for example) web-browsing will function through ispA incase ispB goes down. Edit: This one should be helpful aswell: ... View more

What do you think is the probability that they could if feature requests are filed or have this already been looked into with negative result? ... View more

Could these docs be the ones you are looking for? ... View more

According to page 108 in the admin guide for PANOS 4.1: " GRE encapsulation within IPSec is not currently supported. " but I cant find if GRE without IPSEC is possible... ... View more

Did you file this yet as a feature request through your Sales Engineer at PA? ... View more

If your purpose is that HOST A should be able to reach HOST B at layer2 then I would configure the two interfaces at the PA box as layer2. And then create a vlan-interface in the PA which will be the default gw for HOST A and B. In order to be able to ping the PA itself you need to setup a management profile which you attach to your (in this case) vlan-interface. When you configure the management profile you can select which of the following protocols should be allowed towards the PA ip-address: Ping Telnet SSH HTTP HTTPS SNMP Response Pages along with permitted ip addresses. ... View more

It could of course be a false positive from the ISP, would be great if your customers could get some more info from them like the logs or such for why they think they have Zeus. But of course, it you dont have ssl-termination in place you will be pretty much blind for all sorts of threats. I would highly recommend to enable ssl-termination and use that for ALL ssl traffic (and then only whitelist a couple such as windowsupdate (which cannot be terminated anyway) and perhaps financial/bank sites (by url-category or statically by a custom url-category - the later doesnt need a url-category db license). Speaking of url-categories you could also deny clients accessing known malware-sites and the other bad categories and if possible perhaps limit clients to only known sites (block sites which havent been categorized yet - however the later would also need you to enable dynamic url-db). You should also verify that the clients really have "action:block" for the severitylevels that Zeus is included in (high and medium currently) and that those threat-profiles is attached to all allow rules. There is some more info of Zeus at Zeus 2.0 &#8211; Zeus trojan at its best &#8211; extending its reach to Windows Vista, 7 and Mozilla Firefox - Andreas Baumhof however very little info on the C&C/phone home communications but ssl-libs is mentioned there so I wouldnt be suprised if it uses ssl for the C&C/phone home stuff. ... View more