About EddieRowe

Thanks for sharing the CVE.  I typically get those via email as published but have been out on holiday recently. ... View more

Thanks for sharing the new target date is this month.   The info is in the security bulletin under the Solution section and is up to date as of 5/4/22. ... View more

When we adopted GlobalProtect I was given bad information.  I was under the impression that the portal upgrade process was an all or nothing process.  So I used other tools to upgrade GP versions.  Royal pain as older releases required that you uninstall the app and then install the new version!  So I used AutoIT to create a script since it is a chicken and egg problem.  When it came to the 5.2.x version we ran into all sorts of issues where some systems upgraded and were completely broken which is no bueno even without COVID19.  If I had known you could control things by AD group I would have saved myself so much pain over the last few years!   Grab a copy of the documentation for GP and do some reading as the info is there!  You can use the portal to upgrade clients and control who gets upgraded!  Here are my notes based on my Windows setup: Create two AD universal security groups.  One for "Upgrades" and one for "Do Not Upgrade" which gives you some options.  Remember to update the Authentication Profile so these groups can be used in your authentication profile.   Clone your agent profile for GP.  Save one profile as "Do not upgrade" and one as "Upgrade".  Remember the first match wins so put the "do not upgrade" at the top, then upgrade and then your regular profile(s).   Edit the two new agent profiles so they use the matching AD security group. At this point all of your agent profiles are the same so there is zero chance for any harm.  Now add some test users to each of your groups, sync them to the Palo, login to GP on a test system with the test accounts and verify the agent profile is used for the users as you setup. For the "do not upgrade" agent profile double-check and make sure it is set to Disallow upgrades. (Should be since you are not using this) For the "upgrade" agent profile update  setup your preferences for upgrades.  I initially did "Allow with Prompt" to do testing and then moved to "Allow Transparently". Download the release of the GP client you want to use to the Palo and then activate it.   Upgrades should now flow to those in the "upgrade" AD group. If all goes according to plan you should now be able to add a few people each day to your AD group to upgrade folks across the company without incurring too much risk in case something goes wrong.  I always test the release myself, with my specific "use cases" of what must work.  I then add some IS staff who have admin rights so if something goes wrong they can recover on their own.  Then I move on to picking one model of each PC with one person for testing.  Since we moved to this process for upgrades things have been smooth sailing ( knock on wood). ... View more

I was looking for a way to exclude behavior protection from the IP address that is used by the scanner. ... View more

You can accomplish this by use of the grouping filters. You can set the dynamic group to include agents with a version less than 7.4 and not apply this auto upgrade policy to them; or use a 7.3.x autoupgrade to maintenance versions if you like. Then have a separate group for agents with greater than or = 7.4 to have the auto upgrade policy apply for the 7.4.x line. This will allow you to specify the agent upgrade policies based on the dynamic filters you set.    Use this so your 7.3 agents do not apply the autoupgrade to 7.4 and stay within the 7.3.x version.   Use this filter so agents in the 7.4.x apply the autoupgrade for the 7.4 maintenance release versions.   Hopefully this cleared up the frustration you were experiencing. ... View more

Hi Eddie,  taking into account that you have  Windows 10 x64 v2004 Pro updated and XDR Cortex agent version higher than 7.1. Bitlocker encryption should be supported and working.  I believe that the correct way to handle this is what you have done, opening a support ticket.  Kind Regards, Luis  ... View more

Hi @EddieRowe,    Have you had the opportunity to work with our Support engineers to gather evidence that the Cortex XDR agent is truly impacting your backup software's performance? I would highly suggest doing so to avoid disabling protection where it is likely needed most. They can be reached at https://support.paloaltonetworks.com/. ... View more

Hi @BillStrahan,    Were you able to successfully add the GoToMeeting executable to the allow list using any previous suggestions? ... View more

Hi @EddieRowe,   Did you clear out your filter before doing so? Here are screenshots of the filter working perfectly on a lab tenant. Could you post screenshots of yours perhaps?    ... View more