About kiwi

Palo Alto Networks announces an upcoming general availability of the new Cortex XDR Managed Threat Hunting, an around-the-clock threat hunting service powered by our internationally recognized Unit 42 threat research team. Find answers on LIVEcommunity.     Cortex XDR Managed Threat Hunting Expected in Early June   Security teams rarely have the time and/or the luxury to view and respond to threats, let alone to proactively hunt them. Often these teams are too preoccupied managing alerts, policies and everything else. It's no secret that there's a cybersecurity skills shortage and even the most developed and skilled security teams are experiencing that traditional methods just aren't doing the trick, and they need help in handling the sheer volume of threats and attacks that keep on evolving.   We’re happy to tell you that the help you need has arrived.   Palo Alto Networks is proud to announce the upcoming general availability of Cortex XDR Managed Threat Hunting, an around-the-clock threat hunting service powered by our internationally recognized Unit 42 threat research team.   Made available in February as a limited-time offering, the service has proven its value by identifying real-world attacks for our customers and revealing adversary tactics in third-party testing. In the recent MITRE ATT&CK APT29 evaluation, we surpassed other vendors by scoring a 90% attack coverage.   With Cortex XDR, Palo Alto Networks has created extended detection and response platform . Now, powered by the Palo Alto Networks Unit 42 threat research team the power of Cortex XDR is augmented with a Managed Threat Hunting service, creating the most advanced threat hunting service available today.     How Unit 42 analysts unmask attacks What does Cortex XDR Managed Threat Hunting Deliver? Backed by Unit42: Unit 42 threat hunters leverage emerging threat research to stay ahead of the curve while using the Cortex XDR platform for industry-leading analytics and data exploration. Hunting across endpoint, network and cloud: Leveraging the best minds and machine learning models to detect attacks and improve your security posture. Precise, actionable, and informative reporting.   Cortex XDR Managed Threat Hunting is expected to be available for all customers in early June.      Want to learn more about threat hunting? Join the “Inside the Hunt“   summit on Tuesday, June 23 where experts from around the world will gather and share best practices on security strategies. Learn about the latest techniques and tools to hunt down the most advanced threats.  World-renowned experts from Unit 42 will also discuss identifying never-before-seen threats, verify attacks, and reverse-engineer malware for the Cortex XDR Managed Threat Hunting service.   Register for the “ Inside the Hunt ” summit happening on Tuesday, June 23! https://start.paloaltonetworks.com/inside-the-hunt-virtual-summit   For more details, Zeynep Inanoglu Ozdemir provides an in-depth look in her blog.     Thanks   for taking time to read the blog. If you enjoyed this, please hit the   Like (thumbs up)   button, don't forget to   subscribe   to the   LIVEcommunity Blog.   Stay Secure, Kiwi out!     ... View more

Palo Alto Networks dives into the details of pre-logon mode in GlobalProtect. See GlobalProtect harnesses the combination of user-logon, on-demand, and pre-logon to help secure your endusers from security threats. Find answers on LIVEcommunity.       What exactly is this pre-logon mode in GlobalProtect?   Setting up GlobalProtect can be a daunting task, especially, with all the possible modes available to you. We already discussed user-logon  and on-demand mode. However, all good things come in threes, and the third variant to set up GlobalProtect is pre-logon mode.   The GlobalProtect pre-logon connect method enables GlobalProtect to authenticate the agent and establish the VPN tunnel to the GlobalProtect gateway before a user logs on to a machine. This allows for internal resources to be connected or scripts executed even before a user logs in.   This means that prior to the user login there is no username associated with the traffic. In order to enable the client system to access resources, you must create security policies that match the pre-logon user. These policies should only allow access to basic services required to start up the system, such as DHCP, DNS, Active Directory (for example, to change an expired password), antivirus, and/or operating system update services.    GlobalProtect Security Policy Rule - User Tab for Pre-logon   Once the user logs on to the machine, the tunnel gets renamed for Windows users from the pre-logon user to the actual user who logged in. In the case of Mac users, the tunnel is re-established with the actual user who logged in.   Now, since this deals with two users (pre-logon and actual user), you'll need to configure separate client configs in your portal. One for the pre-logon user and another for any specific user group, which makes this specific setup a bit more engaging than the other two connection modes.    Two views of GlobalProtect Config windows Authentication tab for pre logon and actual user   For step-by-step instructions and to learn all about setting up your GlobalProtect configuration with pre-logon, please review the following Knowledge Base article: Basic GlobalProtect Configuration with Pre-Logon     Thanks   for taking time to read the blog. If you enjoyed this, please hit the   Like (thumbs up)   button, don't forget to   subscribe   to the   LIVEcommunity Blog.     Stay Secure, Kiwi out!   ... View more

Data Loss Prevention (DLP) on Prisma Access   DLP on Prisma Access is a cloud-based service that uses supervised machine learning algorithms to sort sensitive documents into Financial, Legal, Healthcare, and other categories for document classification to guard against exposures, data loss and data exfiltration. These patterns can identify the sensitive information in your cloud apps and protect them from exposure.   While the Prisma Access DLP enhancements resemble the   Data Filtering   implementation that you use with next-generation firewalls or with Panorama appliances, be sure to follow the steps in "DLP on Prisma Access" to implement DLP with Prisma Access; the configuration tasks are different.   DLP on Prisma Access allows you to protect sensitive file data in the following ways: Prevent file uploads from leaking to unsanctioned web applications.  Discover and conditionally stop sensitive data from being leaked to untrusted web applications. Monitor uploads to sanctioned web applications.  Discover and monitor sensitive data when it is uploaded to sanctioned corporate apps.   To help you inspect content and analyze the data in the correct context so you can accurately identify what is sensitive data and secure it to prevent incidents, enhanced DLP on Prisma Access is enabled through a cloud service. Enhanced DLP offers over 250 data patterns and many predefined data filtering profiles, and it is designed to automatically make new patterns and profiles available to you to use in Data Filtering policies, as soon as they are added to the cloud service.   Create Data Patterns – Help you detect sensitive content and how that content is being shared or accessed on your network. Create Data Filtering Profiles – Power the data classification and monitoring capabilities available on Prisma Access to prevent data loss and mitigate business risk.   The data patterns and data filtering profiles are designed to work across Prisma SaaS and Prisma Access to provide consistent data security at all locations—either in the cloud or across various enforcement points in the SaaS applications, remote networks, and mobile users. When you create a new data pattern or data filtering profile on Prisma Access, it becomes available for enforcement on Prisma SaaS so that you can identify and protect data uniformly across connected applications.   To improve detection accuracy and reduce false positives, you can also specify: Proximity keywords Confidence levels Basic and weighted regular expressions     Check out all the details of Enhanced DLP.    The following matrix displays what’s supported with DLP on Prisma Access :   WEB APPLICATION PDF DOC/DOCX PPT/PPTX XLS/XLSX RTF CSV MULTI-FILE UPLOADS FILE SIZE Web browsing Yes Yes Yes Yes Yes Yes Yes 20 MB Onedrive Web App Yes Yes Yes Yes Yes Yes Yes 20 MB Sharepoint Web App Yes Yes Yes Yes Yes Yes Yes 20 MB Gmail Web App Yes Yes Yes Yes Yes Yes Yes 20 MB Box Web App Yes Yes Yes Yes Yes Yes Yes 20 MB Slack Web App Yes Yes Yes Yes Yes Yes Yes 20 MB   Additional Information Register and Activate DLP on Prisma Access Enable DLP on Prisma Access View DLP Logs and File Snippets Introducing Prisma Access Release 1.6       Thanks   for taking time to read the blog. If you enjoyed this, please hit the   Like (thumbs up)   button, don't forget to   subscribe   to the   LIVEcommunity Blog.   Stay Secure, Kiwi out! ... View more

Palo Alto Networks SD-WAN subscription integrates with PAN-OS, providing intelligent, dynamic path selection on top of the industry leading security that PAN-OS software already delivers.     Features Introduced in SD-WAN Plugin 1.0.2 Secure SD-WAN provides the optimal end user experience by leveraging multiple ISP links to ensure application performance and scale capacity. For   upgrade and downgrade considerations   and for specific information about   the upgrade path, refer to the   SD-WAN 1.0 Administrator’s Guide. The administrator’s guide also provides additional information about how to use the SD-WAN Plugin features in this release.   Below are the new features introduced in SD-WAN plugin 1.0.2 along with PAN-OS 9.1.2-h1, which is required for the SD-WAN 1.0.2 plugin. NEW SD-WAN FEATURES DESCRIPTION Branch Prefix Redistribution (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) Prior to these releases, branch firewalls automatically redistributed all non-public, connected routes to the hub. Beginning with PAN-OS 9.1.2-h1 and SD-WAN plugin 1.0.2, you can also redistribute any additional prefixes to the hub. Automatic Security Policy Rule Allowing BGP (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) For ease of use, you can have Panorama automatically create a Security policy rule to allow BGP between branches and hubs. IKE Preshared Key Refresh (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) Refresh the IKE preshared key that VPN cluster members use. This action is especially helpful if you have a mandate to refresh IKE keys periodically. VPN Tunnel IP Address Ranges (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) Specify IP address ranges for Auto VPN configuration to assign to VPN tunnel endpoints to ensure that Auto VPN does not randomly select IP addresses that overlap with those your network uses. VPN Data Tunnel Support (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) You can now control access to the SD-WAN VPN data tunnel to specify how branch to hub traffic is sent (inside or outside the VPN tunnel). Enable or disable this feature from the SD-WAN Interface Profile. DIA to MPLS Failover (PAN-OS 9.1.2-h1 and later 9.1 releases, and SD-WAN Plugin 1.0.2 and later 1.0 releases) Direct Internet Access (DIA) traffic can failover to the hub through the MPLS link to take an alternate route to the internet.   This content was reprinted from the original document in TechDocs. Stay on top of things and bookmark Panorama Plugin for SD-WAN 1.0!       Thanks   for taking time to read the blog. If you enjoyed this, please hit the   Like (thumbs up)   button, don't forget to   subscribe   to the   LIVEcommunity Blog.   Stay Secure, Kiwi out!   ... View more

The Palo Alto Networks BPA for next-generation firewalls and Panorama evaluates your devices' configuration by measuring the adoption of capabilities, validating whether the policies adhere to best practices, and providing recommendations to help remediate failed best practice checks.     The Quarterly Best Practice Assessment (BPA) Reminder The Quarterly BPA Reminder is designed to remind customers to run a new Best Practice Assessment on devices that have a BPA history older than 90 days. This feature will send you a notification via email and another within the Customer Support Portal (CSP).   The email will be sent to users with a BPA role, and it will include their name, serial number, and date of the last BPA for all devices in their account that have not performed an assessment in 90 days or more. You will also receive a link in the email that takes you to the BPA History page, so you can see the affected devices, via flags, and then generate new BPAs. Here's a sample of what the email notification will look like: Email Notification Same for Quarterly BPA Reminder   The CSP notification, however, functions in a familiar manner, given that you've accessed the CSP before. The badge counter reflects a new notification, and the BPA reminder is classified as an Asset Notification, so it will appear in the notification panel as shown below. View of Best Practice Assessment (BPA) History page - Asset Notification   As with the email, the notifications you'll see in the CSP will include a link to the BPA History page. Although the CSP notifications do not provide a list of the affected devices like in the email, you will have the opportunity to generate a Best Practice Assessment. CSP View of Notifications   As the name suggests, these notifications will only be triggered once near the beginning of the quarter. The quarterly reminder will only include devices that have had assessments exceeding the 90-day recommendation within the previous quarter (a 90-day rolling window). NOTE: Devices will not be repeated in future notifications. The email notification will include all devices that meet the necessary criteria, so you will only receive one email about the Quarterly BPA Reminder.   TL;DR? All CSP account holders with a B PA role will be impacted .   Now, Customers will be reminded every quarter when it's time to run a new BPA and better understand the reasons for running the BPA on a regular basis.   Customer Support Portal > Tools > Best Practice Assessment The BPA tool is available for all customers in the Customer Support Portal.  To access the tool, log in to the CSP at support.paloaltonetworks.com and navigate to Tools > Best Practice Assessment.     More BPA information: How To Use The New BPA Functionality  Best Practice Assessment Resource Page on LIVEcommunity      Thanks   for taking time to read the blog. If you enjoyed this, please hit the   Like (thumbs up)   button, don't forget to   subscribe   to the   LIVEcommunity Blog.   Stay Secure, Kiwi out!   ... View more

Palo Alto Networks released Cortex XDR 2.3. Read about the new features available in Cortex XDR 2.3, including Incident, Agent Management, and Global Improvements. See how these features can help keep your network secure.    Features Introduced in April 2020 (release 2.3)   NOTE: Features requiring Cortex XDR agent 7.1 are coming soon and will be available with the agent release.   FEATURE DESCRIPTION Incident Management   OS Actor Visibility and Investigation Cortex XDR now provides complete visibility into OS actors—processes that create a process on behalf of a different initiator. When Cortex XDR detects suspicious activity from an OS Actor, details about the process and activity are available with the alerts and from the Causality View. You can also use the Query Builder to search endpoint data for OS Actor attributes. Causality View Enhancements for Devices When you investigate an alert in the Causality View, Cortex XDR now displays information about any related CD-ROM and Removable media devices including Type, Vendor, Product, and Serial Number. Endpoint Prevention and Management   Script Execution (Requires a Cortex XDR Pro Per Endpoint license and Cortex XDR agent 7.1 or later) You can now run Python 3.7 scripts on your endpoints directly from Cortex XDR. Cortex XDR provides pre-canned scripts for common endpoint remediation and endpoint management actions. You can also write and upload your own Python scripts and code snippets into Cortex XDR. Cortex XDR enables you to manage, run, and track the script execution on the endpoints, as well as store and display the execution results per endpoint. To learn more about script execution, see Run Scripts on an Endpoint. Full Visibility into the Cortex XDR Agent Operational Status (Cortex XDR agent 7.1 or later) From the Cortex XDR management console, you now have full visibility into the Cortex XDR agent operational status on the endpoint, which indicates whether the agent is providing protection according to its predefined security policies and profiles. By observing the operational status on the endpoint, you can identify when the agent suffers from a technical issue or misconfiguration that interferes with the agent’s protection capabilities or interaction with Cortex XDR and other applications. The Cortex XDR agent reports the operational status as follows: Protected—Indicates that the Cortex XDR agent is running as configured and did not report any exceptions to Cortex XDR. Partially protected—Indicates that the Cortex XDR agent reported Cortex XDR one or more exceptions. Unprotected—Indicates that the Cortex XDR agent reported Cortex XDR exceptions about the Malware protection module, and Behavioral threat protection or Exploit modules. You can monitor the operational status of your endpoints from the Endpoint Administration table. See Monitoring Agent Operational Status for the implications the operational status has on the endpoint. Disk Encryption Using BitLocker (Windows only and with Cortex XDR agent 7.1 or later) Cortex XDR now provides visibility into Windows endpoints that encrypt their hard drives using BitLocker, the Microsoft Windows built-in encryption tool. To enable disk encryption visibility, you set Disk Encryption profiles and apply them to Policy rules on your Windows endpoints. Additionally, you can apply Disk Encryption profiles to your enforce the BitLocker encryption or decryption of the endpoint operating system disk.   To provide visibility and interoperability into the encrypted endpoints, Cortex XDR leverages the Microsoft Windows APIs for BitLocker. The Cortex XDR agent applies the Microsoft Windows BitLocker rules on the endpoint according to the Disk Encryption settings configured in the Cortex XDR management console. Host Firewall for Cortex XDR Agents (Windows only and with Cortex XDR agent 7.1 or later) To reduce the attack surface originating in network communications to and from the endpoint, you can now control all inbound and outbound communications on your Windows endpoints with the Cortex XDR Host Firewall. To use the host firewall, you set rules that allow or block the traffic on the endpoints and apply them to your endpoints using Cortex XDR policy rules. To fine tune the network communication configuration on the endpoint, you can apply host firewall rules according to the following: The current network location of the device (inside or outside the network). The direction of the communication on the device (inbound or outbound). IP address or IP address ranges Ports or port ranges The communication protocol (ICMP, TCP, UCP, and ICMPv6). Specific programs running on the endpoint. To control inbound and outbound communication of your endpoints, Cortex XDR leverages the Microsoft Windows Filtering Platform APIs. The Cortex XDR agent applies the Microsoft Windows Filtering Platform rules on the endpoint according to the settings configured in the Cortex XDR management console. Automatic Agent Upgrades You can now ensure your Windows, Mac, and Linux endpoints are always up-to-date with the latest Cortex XDR agent release by enabling automatic agent upgrades. For increased flexibility, you can choose to apply automatic upgrades to major releases only, to minor releases only, or to both. You can set auto-upgrade for Cortex XDR agents running on Windows, Mac, and Linux endpoints in the Agent Settings Profile and apply it to a policy rule.   To configure automatic upgrades for your agents, see Add a New Agent Settings Profile.. Dormant Malware Scanning (Mac only and with Cortex XDR agent 7.1 or later) In addition to blocking the execution of malware, the Cortex XDR agent can now scan the system drives of your Mac endpoints for dormant malware that is not actively attempting to run. During a malware scan, the Cortex XDR agent leverages WildFire to examine mach-O files and system drives only. When a malicious file is detected, the Cortex XDR agent reports the malware to Cortex XDR so that you can manually take action to remove the malware before it attempts to harm the endpoint. While unsupported file types excluded from the scan, additional agent protection capabilities continue to monitor and evaluate those files. Agent Installation through Package Manager (Linux only and with Cortex XDR agent 7.1 or later) You can now create Cortex XDR agent installation packages in .rpm or .deb formats, which are deployed on the endpoint using a Linux package manager. Additionally, you can choose to upgrade existing Cortex XDR agents using the new formats, even if they were installed or upgraded using the Shell installer previously. For the detailed workflow, see Create an Agent Installation Package. New Distribution Support (Linux only and with Cortex XDR agent 7.1 or later) You can now install the Cortex XDR agent on Linux endpoints running RHEL8, CentOS8, Oracle 8, SUSE 15, SUSE 15 SP1, and SUSE 11 SP4 distributions.   The Cortex XDR agent does not enforce injection-based protection modules (ROP Mitigation, SO Hijacking Protection, and Brute Force Protection) on 32-bit processes running on 64-bit SUSE 15 SP1 endpoints. All other exploit and malware protection modules work as expected. EDR is supported only on SUSE 12 SP5, not all SUSE 12 versions. Additionally, the Cortex XDR agent now supports the kernel module for SUSE 12.   For full compatibility information, see the Compatibility Matrix. MAC Address Reporting (Cortex XDR agent 7.1 or later) To gain better visibility into endpoints in your network, the Cortex XDR agent now reports the endpoint MAC address and corresponding IP address to Cortex XDR. You can search and filter endpoints in Cortex XDR according to the MAC address, and can also use the Query Builder to search events by the reporting endpoint MAC address. Endpoints Navigation Changes For improved navigation of endpoint features, the Cortex XDR management console now organizes the Endpoints menus as follows:   Endpoint Management—Includes endpoint administration, endpoint group management, and agent installation package management. Policy Management—Now separated into two sections: Prevention/Security for managing your endpoint profiles, rules, and exceptions; and Compliance for managing your Device Control profiles, rules, and exceptions. Device Control Violations—Quickly view behavior flagged by Cortex XDR agents as matching a Device Control policy rule. Endpoint Group Name Portability When you apply endpoint policy rules to specific endpoint groups, Cortex XDR now uses the unique endpoint group ID for assignment instead of the name. This eliminates the need for you to update your policy rules after you change the name of an endpoint group. Restricting Response Actions on the Endpoint If you want to prevent Cortex XDR from accessing your endpoint and performing invasive actions, you can permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a Live Terminal remote session on the endpoint, execute Python scripts on the endpoint, and retrieve files from the endpoint to Cortex XDR. You disable these actions when you install the Cortex XDR agent on the endpoint. Disabling any of these actions is irreversible, so if you later want to enable the action on the endpoint, you must uninstall the Cortex XDR agent and install a new package on the endpoint. Global Improvements   Broker VM Extended Application Support To ease the deployment of broker VM when using Azure and Hyper-V 2012 and later, you can now download a VDH image from the Cortex XDR management console when configuring your broker VM. Cortex XDR Deployment Enhancements To simplify deployment of Cortex XDR, the list of required firewall URLs to enable has been consolidated. panw-xdr-evr-prod-us.storageapis.google.com is now replacing the following URLs: https://<xdr-tenant>-distributions.storage.googleapis.com https://<xdr-tenant>-agent-uploads.storage.googleapis.com https://migration-<cortex-data-lake-tenant-ID>-agent-uploads.storage.googleapis.com https://migration-<cortex-data-lake-tenant-ID>-distributions.storage.googleapis.com https://xdr-<region>-<cortex-data-lake-tenant-ID>-agent-uploads.storage.googleapis.com https://xdr-<region>-<cortex-data-lake-tenant-ID>-distributions.storage.googleapis.com Public APIs   API Enhancements To improve and simplify the use of the public Cortex XDR APIs, the following enhancements have been made: Request field filters is no longer mandatory for the following APIs: Get Incidents Get Endpoints Get Device Violations Get Audit Management Log Get Audit Agent Report Request either all or filtered results for: Scan Endpoints Cancel Scan Endpoints Get Incidents Get Endpoints Get Device Violations Get Audit Management Log Get Audit Agent Report Simplified request fields for: Isolate Endpoints Unisolate Endpoints Delete Endpoints Quarantine Files Retrieve Files     Stay up to date and bookmark the TechDocs page on Cortex XDR Release Notes.   In addition to the new features listed above, Customers can also view Cortex XDR 2.3 new feature videos.     Thanks   for taking time to read the blog. If you enjoyed this, please hit the   Like (thumbs up)   button, don't forget to   subscribe   to the   LIVEcommunity Blog.   Stay Secure, Kiwi out!   ... View more