About mgusta

Hi,   I would like to stop (block) an ip when there are a number of failed logon attempts but I cant get it to work. The vulnurability signatures are not being triggered. The other day someone tried over 400 different user names against out owa. 6 tries for each. None were sucessfull, and we use MFA, but I still want to halt the attack. Can it be done? I´ve enabled inbound decryption and now I see application Outlook-web insteaf of just ssl. I´ve also created exceptions for all brute force signatures to trigger after just 5 repeats for testing. But no child signatures (failed log on attempt etc.) are triggered so the parent signature never fires no matter how low I set the threashold. What could be wrong? Is the decryption still not working fully so the failed attempts are hidden in the ssl stream? How can I troubleshoot?   Thanks,   Mikael ... View more

Hi,   When trying to use Minemeld to enable access to Office365 MS Teams brakes. This is because url api.teams.skype.com is not in the url list minemeld pulls. Instelad this url is being categorized as 'internet-communications-and-telephony' by panos and that category is blocked in the url filter. Also, we have other url categories we´ve manually created to disable ssl decryptions for some sites. This also becomes a problem as Panos then identifies these sites as belonging not to minemelds EDL but the other list. In which order is the different URL category list processed? Nayway, what is the best way to manage this? Can I manually add an url to minemeld?   Thanks,   Mikael ... View more