About itchelpdesk

We had a similar issue with RPC timeouts but turned out to be the application components crashing.   The distro was pushed from Ubuntu 16 to 18 which has a different set of libraries causing issues with the Minemeld apps.   I read a couple of other LIVE posts that advise to use the docker instance instead of the bare metal install on Ubuntu.   No idea of the project is still active, but I have seen a few minor commits recently although not sure if released.   There is no commercial support for the product as far as I am aware.   Thanks,   Dimi     ... View more

Hi,   I believe your problem is much simpler than adjusting the underlying mech of the redis server - although it's a good read.   net.core.somaxconn=1024 - this can have some perfomance benefits. Look up Redis optimizations.   The real issue is though that you probably installed Minemeld on an unsupported *nix distribution.   If you are getting segfaults in your dmesg from the Minemeld apps, that is probably what's causing all the crashes as it breaks the IPC pipes (the communication between the different components) - library compatibility basically.   For more information or details, check this post:   https://live.paloaltonetworks.com/t5/minemeld-discussions/minemeld-crash-once-in-a-while/m-p/329765#M3673   Thanks for the pointers regardless,   Dimi     ... View more

While this can get you the data you're looking for, it is still page-by-page, and not readily printable.  However, we do have a feature coming down the pipeline that will allow you to perform a CSV export of all signatures in a given profile.  You will be able to use this feature with a wildcare profile to get the report you're looking for. Hi! Can you please advise in which version the feature will be enabled to export the vulnerability information in CSV? Regards. ... View more

If you raise your level to "block" and the threat is detected the  firewall will, as the name suggests, block the traffic from transitting. Now, if you're 100% sure the threats being detected are valid, then I suggest you might want to block them. If,  however, you're worried about false positives - then don't. The block  action may well break soemthing, especially if it triggers a positive  threat detection when it's not really a threat. "Alert"  is good if you have time to sit and watch threat logs, and can get on  top of reported threats immediately - if you're like msot people and  DON'T have this time, then block is a good option. Depends how paranoid  you are, and how critical potentially blocking a valid action might be. Hi! I just checked and it doesn`t seem to be possible to export this list of vulnerabilities and default actions when you go Objects> Antivirus, Anti-spyware and Vulnerability Protection and then choose New - Custom. Where is the list available in printable format? Your quick answer would be much appreciated. Regards. ... View more