About marcelocampos

good day community, I have an incident due to the execution of an excel file that contains macros. According to the verdict and its hash the file is not a threat. My question is the following which is the most suitable method to allow the execution of said file? In the incident analysis window, right click on the allow list process or generate an exclusion? what is the difference?   Best regards ... View more

hello community,   I have a question that I have not been able to solve with the study material and it keeps breaking my head. Here it goes, when I generate an application-based security policy, for example from "trust" 10.xxx to "untrust" any with app anydesk specification (with the ssl dependency), I see the corresponding traffic between the internal lan and the destination on the internet corresponding to anydesk is fine, but here comes the doubt, I see traffic to other addresses by ssl but the record indicates that the application is incomplete (understanding that after the 3-way handshake there is no more packets) can I assume that traffic is not establishing a session and that the policy is doing its job of accepting "ANYDESK" and denying everything else? As long as the application output is incomplete, that traffic is not being established even though the traffic log indicates allow?. And the last one, when I configure a security policy towards any internet, only specifying the application and its dependencies, am I opening a communication flow towards any destination according to the applications and dependencies?   example a conection ssl to microsoft destination can forward by the policy maked for anydesk?    Thank you in advance for your guidance and clarification. ... View more

In my company we are generating authorized pishing test scenarios to test users who compromise their assets when interacting with pishing links in their emails, for this we want to collect information and statistics on who opened the email, clicked on the link and / or entered personal information. To then generate awareness campaigns. The tool used is called Smartfense, we previously tested with Cofense but we had the same result. The problem is that the links contained in the emails are previously analyzed by the PAN DB URL, which corrupts the test results generating false positives. The data of our corporate firewall are: Model PA3250 S.O version 9.0.9h1.   Inbound security policies were configured allowing in the policy a customized url pointing to the url of the Smartfense tool, according to the information released by the tool manufacturer. Even so, the links continue to be analyzed.     Has anyone had the same problem ?, I remain attentive to your kind help. Regards.     ... View more