About almraza

  We intend to introduce a new category called “Scanning Activity” under Advanced URL Filtering.    ACTION: Your action is required. By default, we set the “Scanning Activity” category to “Block” mode for the default profile only. If you have multiple URL Filtering profiles, we recommend that you change the default action to “Block” for this category in each of your profiles.   How is Scanning Activity Defined? Palo Alto Networks defines the 'Scanning Activity' category to include URLs associated with malicious campaigns conducted by adversaries. Such activities sometimes serve as indicators of compromised user machines that are probing for existing vulnerabilities. These actions are typically part of reconnaissance activities carried out by adversaries.   Will the “Scanning Activity” category be visible across all versions of PAN-OS? Yes, the Scanning Activity category will be visible across all supported PAN-OS versions. However, it is functional only for firewalls running PAN-OS 9.1 and later versions and requires  an Advanced URL filtering license.    When will the “Scanning Activity” category be available? The “Scanning Activity” category will be visible on the administrator management console after you install the content release scheduled for July 11, 2023 (or a later version). However we will not begin publishing URLs to this new category until October 11, 2023.    When will the “Scanning Activity”  category be functional? Starting October 11, 2023, Palo Alto Networks will start publishing URLs that are categorized as “ Scanning Activity.” Please ensure that your Security policy rules are configured to account for this new category.   What is the recommended action for the “Scanning Activity” category? Scanning activity is an indicator of compromise that can pose a serious threat to users and businesses. Therefore, we recommend that you keep the default action for this category set to “Block.” Note: The “Scanning Activity” category action is set to “Block” only for the default profile. If you have multiple URL Filtering profiles, an administrator must update the default action to “Block” for this category in each of your profiles. This requirement applies to all supported versions of PAN-OS software.   What is the Palo Alto Networks test URL for Scanning Activity? http://urlfiltering.paloaltonetworks.com/test-scanning-activity   Additional Information For more information on best practices when managing Advanced URL Filtering categories, please read our  URL Filtering Category Recommendations   Complete List of PAN-DB URL Filtering Categories   ... View more

  Palo Alto Networks is releasing a new category called “Encrypted-DNS” under Advanced URL Filtering.    ACTION: By default, the “Encrypted-DNS category” action is set to "Allow". Palo Alto Networks recommends configuring your URL Filtering security profile(s) to "Block" DNS over HTTPS (DoH) requests if it is not permitted (unsanctioned) within your network. If DoH is already blocked as part of your Decryption and App-ID configuration and no additional action is required (as outlined here:  Protecting Organizations in a World of DoH and DoT).   What is the “Encrypted-DNS” category? Unlike traditional DNS, protocols like DNS over HTTPS encrypt DNS requests and responses to ensure privacy and security for end users. Support for DoH is available and is enabled by default on all popular browsers such as Google Chrome and Mozilla Firefox, as well as leading software vendors like Apple and Microsoft. Encrypted-DNS is a new category added in the Advanced URL Filtering subscription to handle DoH traffic.   Will the “Encrypted-DNS” category be visible across all PAN-OS versions? Yes. It is however only supported on PAN-OS 9.1 and above. For PAN-OS version 9.0 and below, Encrypted-DNS detections will be covered under the category “Computer-and-internet-info".   When will the “Encrypted-DNS” category be available? The “Encrypted-DNS” category will be visible on the administrator management console beginning October 6th, 2022, although we will not use the category to classify web pages until December 8th, 2022.     When will the “Encrypted-DNS” category be functional? Starting December 8th, 2022, Palo Alto Networks will start publishing URLs that resolve DoH queries (DoH resolvers). Please ensure that your security policy rules are configured properly for this new category.     Note: The Encrypted-DNS category functionality will only be supported on PAN-OS versions 9.1 onwards. For PAN-OS version 9.0 and below, Encrypted-DNS detections will be covered under the “Computer-and-internet-info" category.   What is the recommended action for the “Encrypted-DNS” category? Protocols like DoH encrypt DNS queries and hide the domains requested by a user. By blocking DoH traffic, applications using DoH fall back to regular DNS, allowing organizations to gain visibility and control of their internet traffic.   ACTION: Our recommendation is to "Block" Encrypted-DNS traffic in your URL filtering security profiles.    Note: In an upcoming PAN-OS release, the DNS Security subscription will support inspection of DNS over HTTPS traffic. With this support, this new category can be used to enforce decryption of DoH traffic and apply DNS Security inspection. Please stay tuned for further information.     Additional Information: For more information on best practices when managing URL Filtering categories, refer to these resources: URL Filtering Category Recommendations Complete List of Advanced URL Filtering Categories   ... View more

Ransomware Starting September 27, 2022, Palo Alto Networks will start publishing URLs into the newly introduced category  “Ransomware” available with content release version 8592 and above.   ACTION:  Action will be required. Ransomware category action is set to “block” only for the default profile. If you have multiple URL Filtering Security profiles, you need to update the default action to BLOCK for each of these profiles.   How is Ransomware defined? Palo Alto Networks defines Ransomware as websites known to host ransomware or malicious traffic involved in conducting ransomware campaigns that generally threaten to publish private data or keep access to specific data or systems blocked, usually by encrypting it, until the demanded ransom is paid.   Will the “Ransomware” category be visible across all PAN-OS versions? Yes. It is, however, only supported on PAN-OS 9.1 and above. For PAN-OS version 9.0 and below, Ransomware detections will be covered under the category “Malware”. Note: The “Ransomware” category cannot be used in PAN-OS 9.0 or below.   It is visible on the GUI as a setting even in PAN-OS 9.0 or below. However, no URL will ever be identified as "Ransomware" category in PAN-OS 9.0 or below.   When will the “Ransomware” category be functional? Starting September 27, 2022, Palo Alto Networks will start publishing URLs that are categorized as ransomware. Please ensure that your security policy rules are configured properly for this new category.     Note: Ransomware category functionality will only be supported on PAN-OS versions 9.1 onwards. For PAN-OS version 9.0 and below, ransomware detections will be covered under the Malware category.   What is the recommended action for the “Ransomware” category? Similar to the command-and-control (C2) and malware categories, ransomware attacks pose a serious threat to users and businesses, therefore Palo Alto Networks recommends customers to keep the default action for this category set to “BLOCK”. Note: The ransomware category action is set to “block” only for the default profile.     ACTION: If you have multiple URL Filtering security profiles, you need to update the default action to “BLOCK” for each of these profiles.   What is the Palo Alto Networks test URL for Ransomware? The test URL for ransomware is http://urlfiltering.paloaltonetworks.com/test-ransomware   Does this new category impact me? Yes. The ransomware category action is only set to “block” for the default profile. If you have multiple URL Filtering security profiles, you need to update the default action to “BLOCK” for each of these profiles.   Additional Information For more information on best practices when managing URL Filtering categories, check out these resources: URL Filtering Category Recommendations Complete List of PAN-DB URL Filtering Categories     ... View more

In late March 2021, we will be introducing a new category, “real-time-detection” to the URL Filtering category list. The “real-time-detection” category will be used by customers who are beta testing the new “Advanced URL Filtering” feature. It will not be functional without a proper beta license. Please contact your account team if you wish to participate in this beta testing program.   There is no impact to customers not participating in the beta and no action required of them.    Below is an FAQ regarding the “real-time-detection” category.   New URL Filtering Category: "Real-time-detection" I am not participating in the beta. Do I need to do anything regarding the new category? No, nothing needs to be done if you are not participating in the beta program for this new “Advanced URL Filtering” feature. The real-time-detection category will only be functional with proper license required to enable the “Advanced URL Filtering” feature during beta.   Is the “real-time-detection” category visible across all PAN-OS versions? Yes, real-time-detection category is visible across all PAN-OS releases.    Am I going to see any URL Filtering log entry for this category without participating in the beta? No, you won’t see any log entry with “real-time-detection” category since the category will not be functional without an additional license required to run the “Advanced URL Filtering” feature during beta.   When will real-time-detection category be functional? Late March 2021 for those participating in the beta program.   What are the Palo Alto Networks test URLs for the “real-time-detection” category? You can use the following test domains to test “real-time-detection” categories. These testing URLs are 100% benign, and have been categorized to their respective categories for testing purposes.   http://urlfiltering.paloaltonetworks.com/test-real-time-detection-command-and-control   http://urlfiltering.paloaltonetworks.com/test-real-time-detection-malware   http://urlfiltering.paloaltonetworks.com/test-real-time-detection-phishing   http://urlfiltering.paloaltonetworks.com/test-real-time-detection-grayware Additional Information   Best Practices: URL Filtering Category Recommendations     ... View more