This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About DKasabji
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About DKasabji
02-09-2021
23Posts
6Likes
1Solution
Feb 09, 2021Last Visited
User
Activity
User
Profile
Latest posts by DKasabji
| Subject | Views | Posted |
|---|---|---|
| 2410 | 01-27-2021 06:02 AM | |
| 4982 | 01-21-2021 06:08 AM | |
| 5312 | 01-21-2021 05:51 AM | |
| 5338 | 01-21-2021 04:55 AM | |
| 6829 | 01-21-2021 01:24 AM | |
| 1278 | 10-27-2020 12:13 AM | |
| 6151 | 09-15-2020 11:27 PM | |
| 5978 | 09-15-2020 11:25 PM | |
| 5298 | 09-15-2020 02:12 PM | |
| 6397 | 09-15-2020 08:19 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 09-13-2020 08:01 AM | |
| 3 Likes | 09-13-2020 07:56 AM | |
| 1 Like | 09-13-2020 11:20 AM | |
| 1 Like | 09-13-2020 11:27 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 09-10-2020 11:08 PM |
| Date Last Visited | 02-09-2021 03:25 PM |
| Posts | 23 |
| Total Likes Received | 6 |
01-27-2021
06:02 AM
Hello PAN Community, I am trying to import SSL certificates to Broker VM. However, when I try to import Private Key, it does not prompt me for the password. Does this mean I have to export the Private key without requirement for passphrase? Thanks. D
... View more
01-21-2021
06:08 AM
This look like a solution I was looking for David, thanks. I will give it a read. I have to see what else it requires to gain such visibility (Network Mapper, Pathfinder, Directory Sync, etc.). Thanks. D
... View more
01-21-2021
05:51 AM
Yep, aware about this one. However, this only works if all endpoints are joined into to the Domain (AD). It cannot detect endpoints that are not part of the domain. Was hopping Cortex would have some sort of passive scanner with Pathfinder to detect endpoints in environment and then populate them in Endpoint Administration console and mark them if they do not have agent installed (similarly like Directory Sync does). Best, D Was hopping there was some sort of passive scanner that would di
... View more
01-21-2021
04:55 AM
Hey @dfalcon , I am inquiring about Pro. We are PAN partners and I am responsible for Cortex XDR POCs etc. and it often comes this question, how to detect endpoints that do not yet have installed XDR Agent in their environment. D
... View more
01-21-2021
01:24 AM
Hey guys, I am curious about if there is a way to find out which Endpoints in certain environment do not yet have XDR Agent installed. I still two options, but had no practical experience in testing it: 1. Directory Sync with Cortex XDR. Would it detect endpoints (which are in AD) that do not have XDR Agent yet installed? 2. Pathfinder. Would Pathfinder be something useful to detect such cases, even for those that are not in AD? Any other option? Thanks. D
... View more
10-27-2020
12:13 AM
Hey guys, Do we have any info when will WF support Win10 VMs for Malware Analysis? I have done some some pre-sales presentations to our customer for Cortex XDR and mentioned the cool built-in feature for malware analysis, however, customer pointed out that the reports are only for WinXP and Win7, which are outdates nowadays. I then checked our WF standalone (subscription) and indeed, that one too also analyzes the files on WinXP and Win7. I think it is quite necessary that PAN addresses this. Windows 10 OS was released 5 years ago, so a lot of business and organizations upgraded their OS versions by now. While this feature being built-in to Cortex XDR is awesome, customer's will see PAN products as out-dates due to such 'support'. Best, D
... View more
09-15-2020
11:27 PM
OH crap! I forgot. The 'Prevent' license probably does not have the option to create BIOCs? Have no experience with Prevent license type, my bad.
... View more
09-15-2020
11:25 PM
@EddieRowe Hm. Then the last thing that comes to mind is to create a Prevention BIOC rule which you can apply to Restriction Profile. You'd create a BIOC something like: Process name: *.exe Path: %USERPROFILE% (and any other path you want to prevent EXEs to not run) Signature: SIGNED Signer: NOT 'GoToMeetings' (etc.) Then you set it in Restriction Profile as the Prevention Rule. This means that everytime an EXE process will execute that is in %USERPROFILE% and it is NOT signed by GoToMettings --> block the execution. Maybe this could help you. But if you already decided on AppLocker, then never mind. Best, D
... View more
09-15-2020
02:12 PM
@EddieRowe Aren't you able to disable Tamper protection on Windows? That way you can disable Defender via GPO.
... View more
09-15-2020
08:19 AM
Forgot to add before: I think the Block-listing approach is probably not the best, because I haven't tested the combination of Blocking everything in a specified folder, but then allowing a specific .EXE to run in that same folder. Not sure what takes precedence: does XDR first check the allowed list and then moves on to check the block list or vice versa. However, maybe you could configure it in a Allow-list approach by defining a Folder where you would allow the executables to run and everything else is blocked. But probably that is a bit to cumbersome to manage for end-users. Or even specific Files, which is (I think) similar to AppLocker approach.
... View more
09-15-2020
08:15 AM
For what you just described, I indeed would favor AppLocked approach, since it is designed to perform this. I am not sure about specifics of XDR Prevent, probably does not have all the capabilities that Pro Per Endpoint or Pro Per TB editions, but don't you have in your XDR Interface the option to configure 'Restrictions Profile'? It is in Endpoints -> Policy Management -> Profiles. You locate the Restrictions profile and Edit it. There you will find Executable Files paragraph where it asks you to input Files / FOLDERS in BLOCK LIST or in ALLOW LIST. So perhaps you could leverage this to specify that any executable within %USERPROFILE% is on BLOCK LIST. Is that not possible in XDR Prevent? Best, D
... View more
09-14-2020
01:12 PM
Hello, Ah, OK. I did send e-mail to the address you provided. I sent it yesterday, but was hopping to receive some update by today. Weird issue though. Thanks for replying.
... View more
09-14-2020
10:28 AM
Hey guys, I just completed PSE Professional certification and received on e-mail that I can look up my Certification. This would be my first time logging, so I chose that option. When I enter my e-mail address that I used to apply for exam, I get this message: Unfortunately, more than one candidate in the system is using this email address. You will need to contact Customer Support or use the information from a score report. I tried using the Score Report option, but it is the same message. I have contacted customer support yesterday, but I haven't yet received any response. Anyone else have / had similar issues? Best, D
... View more
09-14-2020
06:11 AM
Will be interesting to see what the root cause was. Sounds like there is no transmission between Endpoints and Console for only just policies, which is weird. Have you tried accessing the Endpoint via Console through Live Terminal? Or run any script from Action Center? Just to see if you are able to interact with them.
... View more
09-14-2020
04:55 AM
Hmm. I am sure PA will be able to help you as they can see more details. I know that in our case it is working normally. Have you checked that the policy is correctly applied to the endpoints? Best, D
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-09-2021
03:25 PM
|
Likes From
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks