About btenberge

I've been trying to access the Apps hub (https://apps.paloaltonetworks.com/) for days now and I keep getting this error: {"statusCode":500,"error":"Internal Server Error","message":"An internal server error occurred"} Is there any ETA when this issue will be resolved? ... View more

I noticed the default action for the new "NAT Slipstreaming Detection" signatures are set to Alert. How come they are not set to Drop or something else that stops this attack in its tracks?   Also, is there a best practice on protecting against attacks, such as this one, in general? Or does it come down to personal/company preference? For example, do I create exceptions on the used Vulnerability Protection profiles and change the action there? Or is there a better way? What would be the best and safest action to use in these cases, Drop, Block IP (client or server?), or Reset [client|server|both]? When do I use Reset client, Reset server or Reset both and why do I use this instead of Drop or Block IP?   I read the documentation about the differences between these actions, but I still don't understand it enough to pick the right action all the time. I'm still thinking in dropping unwanted traffic the old fashioned way.   ... View more

Hi, Recently I watched the Cortex XDR 2.0 migration information video and there was mention of having to need to upgrade the on-premise Broker VM. I wanted to make sure we are ready for the migration and, if necessary, prepare our environment where needed.   In the updated Broker VM installation documentation, I saw some new things, like configuration through a web page. Having tested that on out on-prem Broker VM, I found out there is no web-ui listening. So I figured I need to upgrade it. I checked our on-prem Broker VM version and it's at 6.2.12. Then I went to the download assets page and noticed the latest available version in 6.1.4. This doesn't look like an upgrade to me. When I restarted the services on our Broker VM for a test, I noticed webui.service as being inactive.   What do I need to do now? Do I still need to deploy the latest Broker VM? Or can I activate that webui somehow? I would really like to have everything ready before next weekend, when we are being migrated to Cortex XDR 2.0 (we are currently using TMS). ... View more

I've been creating security rules to allow Traps Management (with the traps-management-service App-ID) pretty tightly by also defining destination networks (using FQDN objects for the multiple <tenant> .traps.paloaltonetworks.com and common contentprod and distributions hosts).   According to the documentation on https://docs.paloaltonetworks.com/traps/tms/traps-management-service-admin/get-started-with-tms/enable-access-tms.html it should be enough to simply use the App-ID and keep it at that. So now that got me thinking, does the traps-management-service App-ID take destination networks into account? Am I too paranoid doing things like this, or is it good practice to keep security rules as tight as possible, even with App-ID's? ... View more