This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences

About VSU_ITSEC

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
VSU_ITSEC
‎01-31-2023
since ‎03-03-2014
L2 Linker
User Activity
User Profile
Latest posts by VSU_ITSEC
View All
User Badges
Community Statistics
Member Since ‎03-03-2014 10:23 AM
Date Last Visited ‎01-31-2023 12:00 PM
Posts 37

Software Update Issue

by in General Topics
‎10-13-2014 05:44 AM
‎10-13-2014 05:44 AM
Last month I upgraded to 6.0.4 with no issues.  I upgraded my primary, then upgraded the secondary five days later. Again, no problems. When I upgraded to 6.0.5 h3 (this past weekend), the PA would not pass traffic. I returned to 6.0.4 and traffic restored. I then tried 6.0.5 and had the same problem - no traffic. I followed the same procedures as I did with the upgrade to 6.0.4. Any ideas? Thanks as always. //moe ... View more

Re: HA dedicated to Fiber

by in General Topics
‎10-09-2014 10:27 AM
‎10-09-2014 10:27 AM
Thanks. I found that quickly.  So I can use the fiber for both HA 1 & 2, correct? ... View more

HA dedicated to Fiber

by in General Topics
‎10-08-2014 02:25 PM
‎10-08-2014 02:25 PM
I'd like to move my HA connection from the dedicated ports to fiber ports, however I don't have the option do change the port. Am I able to do this? Do I have to disable the HA first? Lastly, will I be able to keep the remaining settings? If I am able to do this, is it advisable? I recall from training that running the HA over a network wasn't a suggested practice. Thanks as always... //moe ... View more
Labels:

Re: malware??

by in General Topics
‎09-25-2014 02:38 PM
‎09-25-2014 02:38 PM
@PA-5020-P(active)> test url g.symcd.com g.symcd.com computer-and-internet-info (Base db) expires in 0 seconds g.symcd.com computer-and-internet-info (Cloud db) I see where you are going w/this….  So… Am I to verify each entry on my botnet report prior to taking action? Am I getting URL updates soon enough, an if not, where do I adjust? Am I placing too much ‘faith’ in the botnet report? From the botnet report: confidence    Virtual System    description 4    vsys1    Repeatedly visited (42) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (441) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (65) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (59) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCK7KMAoI08AAGfwI84AAACi 4    vsys1    Repeatedly visited (40) the same malicious URL acuityplatform.com/Adserver/exds?xuid=8f02281c60d856473aab5158f5ac729c 4    vsys1    Repeatedly visited (123) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (190) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (63) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLtJMAoI0gAAHjWIP0AAABR 4    vsys1    Repeatedly visited (68) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (65) the same malicious URL acuityplatform.com/Adserver/exds?xuid=ef8c5c814844f7f359896d10d97045dd 4    vsys1    Repeatedly visited (100) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36931 4    vsys1    Repeatedly visited (51) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLVhsAoI0YAACmlXH8AAACE 4    vsys1    Repeatedly visited (198) the same malicious URL g.symcd.com/MEkwR6ADAgEAMEAwPjA8MAkGBSsOAwIaBQAEFLG0OReQFreXeVAR8WC51KI82+3uBBQA+SrDQZG2ycK4PlXywJcRE6AHIAIDAjp2 4    vsys1    Repeatedly visited (39) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLTtsAoIz0AAAZPA.MAAACV 4    vsys1    Repeatedly visited (45) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36931 4    vsys1    Repeatedly visited (73) the same malicious URL acuityplatform.com/Adserver/atds?getuserid=http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID 4    vsys1    Repeatedly visited (157) the same malicious URL acuityplatform.com/Adserver/atds?getuserid=http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID 4    vsys1    Repeatedly visited (47) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLeicAoI0YAAD4Vd2cAAAAD 4    vsys1    Repeatedly visited (121) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCMOwMAoI0oAAEKePowAAADV 4    vsys1    Repeatedly visited (45) the same malicious URL acuityplatform.com/Adserver/atds?getuserid=http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID 4    vsys1    Repeatedly visited (36) the same malicious URL assets.tumblr.com/fonts/gibson/stylesheet.css?v=3 4    vsys1    Repeatedly visited (575) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (43) the same malicious URL acuityplatform.com/Adserver/exds?xuid=41ed950b4ac8a2da0effdb75f6b13fe2 4    vsys1    Repeatedly visited (45) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36953 4    vsys1    Repeatedly visited (127) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLQicAoIzcAAIBXHTwAAAD7 4    vsys1    Repeatedly visited (133) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (107) the same malicious URL cache.dtmpub.com/js/ncg6/0/optinrt_0.js?cgver=36939 4    vsys1    Repeatedly visited (38) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLi5cAoI0oAAJ2eaAIAAAAD 4    vsys1    Repeatedly visited (150) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (38) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCLwVMAoIzsAABrw-C0AAAE8 4    vsys1    Repeatedly visited (42) the same malicious URL cdn.mxpnl.com/libs/mixpanel-2.2.min.js 4    vsys1    Repeatedly visited (187) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (58) the same malicious URL acuityplatform.com/Adserver/cmds?cm_dsp_id=10&cm_callback_url=http:/dsum.casalemedia.com/rum&cm_user_id=VCL9o8AoIzMAABBzJg0AAABO 4    vsys1    Repeatedly visited (51) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (85) the same malicious URL g.symcd.com/ 4    vsys1    Repeatedly visited (54) the same malicious URL g.symcd.com/MEkwR6ADAgEAMEAwPjA8MAkGBSsOAwIaBQAEFLG0OReQFreXeVAR8WC51KI82+3uBBQA+SrDQZG2ycK4PlXywJcRE6AHIAIDAjp2 4    vsys1    Repeatedly visited (163) the same malicious URL acuityplatform.com/Adserver/atds?getuserid=http://ums.adtechus.com/mapuser?providerid=1027;userid=$UID 4    vsys1    Repeatedly visited (70) the same malicious URL ortc-ws6-useast1-s0003.realtime.co/ 4    vsys1    Repeatedly visited (555) the same malicious URL g.symcd.com/MEkwR6ADAgEAMEAwPjA8MAkGBSsOAwIaBQAEFLG0OReQFreXeVAR8WC51KI82+3uBBQA+SrDQZG2ycK4PlXywJcRE6AHIAIDAjp2 ... View more

Re: malware??

by in General Topics
‎09-25-2014 08:27 AM
‎09-25-2014 08:27 AM
Have a new site in today's list with the same issue: g.symcd.com.  This is new for us (so is the device); how often does this happen? ... View more

Re: malware??

by in General Topics
‎09-23-2014 10:53 AM
‎09-23-2014 10:53 AM
... View more

Re: malware??

by in General Topics
‎09-23-2014 10:41 AM
‎09-23-2014 10:41 AM
from the CLI @PA-5020-P(active)> test url www.googletagservices.com/tag/js/gpt.js www.googletagservices.com/tag/js/gpt.js search-engines (Base db) expires in 0 seconds www.googletagservices.com/tag/js/gpt.js search-engines (Cloud db) i'll get the URL/threat log in a few... ... View more

Re: malware??

by in General Topics
‎09-23-2014 10:19 AM
‎09-23-2014 10:19 AM
URL googletagservices.com Category   Search Engine Any yes, that was my PAN- OS version #, my bad... URLfiltering is 2014.09.22.470 ... View more

Re: malware??

by in General Topics
‎09-23-2014 08:20 AM
‎09-23-2014 08:20 AM
6.0.3 ... View more

malware??

by in General Topics
‎09-23-2014 07:58 AM
‎09-23-2014 07:58 AM
Dumb question perhaps, but why is www.googletagservices.com/tag/js/gpt.js being flagged as a malicious URL?  It doesn't come up that way in PA's URL filtering site. It's created a considerable jump in my botnet list. Thanks in advance... //moe ... View more
Labels:

Re: ssh (or any) threshold?

by in General Topics
‎08-28-2014 06:26 AM
‎08-28-2014 06:26 AM
sample ... View more

Re: ssh (or any) threshold?

by in General Topics
‎08-28-2014 06:14 AM
‎08-28-2014 06:14 AM
i believe so.  the connections don't match that vulnerability, which i have "reset-both" assigned to it. ... View more

ssh (or any) threshold?

by in General Topics
‎08-28-2014 05:44 AM
‎08-28-2014 05:44 AM
I'm experiencing a ton of hits over ssh to servers that must have ssh access. Is there a way to do threat assessment based on SSH,  port etc – and then automatically shut the attack down?  For example if a certain IP begins sending all that traffic on port 22 within a certain timeframe – we shutdown the traffic and blacklist the IP.  What would be better is to limit this rule to a certain scope – say all of China and Korea where we know attacks tend to happen from – this will help keep down false positives. thanks //moe ... View more

Re: CryptoWall??

by in General Topics
‎06-30-2014 06:38 AM
‎06-30-2014 06:38 AM
thank you! ... View more

CryptoWall??

by in General Topics
‎05-13-2014 11:34 AM
‎05-13-2014 11:34 AM
I did a search for this... came up w/nada. Has there been any convo about CryptoWall?  Has PA addressed it? thanks //moe ... View more
Register or Sign-in
Contact Me
Online Status
Offline
Date Last Visited
‎01-31-2023 12:00 PM
Latest Tags
No tags yet
Likes Given To
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2024 - Palo Alto Networks