About Chris_Johnston

Has anyone had success in creation of threat signatures for ICMP type?  I've seen (and tested) the Palo Alto guide on creation of an app to block/allow specific ICMP types and was trying to log a threat event for potential use and visibility versus creation of a new application (and needing to create a new app-id group to accommodate all ICMP types)   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFZCA0   Working app-id CLI: set application icmp-type8 default ident-by-icmp-type type 8 set application icmp-type8 subcategory ip-protocol set application icmp-type8 category networking set application icmp-type8 technology network-protocol set application icmp-type8 risk 1 Non working threat CLI: set threats vulnerability 44008 signature standard icmp-req-data and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match pattern 8 set threats vulnerability 44008 signature standard icmp-req-data and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match context icmp-req-data set threats vulnerability 44008 signature standard icmp-req-data and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match negate no set threats vulnerability 44008 signature standard icmp-req-data order-free no set threats vulnerability 44008 signature standard icmp-req-data scope protocol-data-unit set threats vulnerability 44008 default-action alert   set threats vulnerability 44008 threatname chrisvuln-icmp-type8 set threats vulnerability 44008 severity informational set threats vulnerability 44008 direction both set threats vulnerability 44008 comment "ICMP type 8" set threats vulnerability 44008 affected-host client yes ... View more