This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About Eric_Geater
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About Eric_Geater
03-30-2023
6Posts
0Likes
0Solutions
Mar 30, 2023Last Visited
User
Activity
User
Profile
Latest posts by Eric_Geater
| Subject | Views | Posted |
|---|---|---|
| 129 | 02-22-2023 11:31 AM | |
| 265 | 02-14-2023 01:54 PM | |
| 247 | 02-06-2023 07:12 AM | |
| 333 | 02-03-2023 08:31 AM | |
| 294 | 01-20-2023 05:36 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 11-07-2022 07:04 AM |
| Date Last Visited | 03-30-2023 10:55 AM |
| Posts | 6 |
02-22-2023
11:31 AM
Thanks for your response. So the answer could be either two, or two million... or somewhere in between. 🙃
... View more
02-14-2023
01:54 PM
Occasionally, I see an alert with the description of "LDAP: User Login Brute Force Attempt". If I'm reading the tea leaves correctly, we're relatively confident that we're observing a failed logon for someone performing maintenance on a specific device.
But it would be nice to know what Cortex constitutes as a "brute force attempt". Is it three? Two? Ten? Five failed attempts in two minutes? I have yet to find documentation through granular google searches. Anyone else?
thanks!
... View more
02-06-2023
07:12 AM
" generic:vzwebsite "
In the quotation marks above, I pasted what was copied to the clipboard from Cortex. No, everything was not automatically selected. It didn't even capture the ellipsis ("...") at the end of the line.
Thank you for your response, however.
... View more
02-03-2023
08:31 AM
Good morning. The provided image is a screencap which appears when I select a single Result in an Incident. Notice that I used the mouse to select the entirety of the path which appears in the browser, while the hover shows that there's much more path that's unavailable for mouse selection.
There doesn't seem to be any tools which make the whole path available for mouse selection, copy and paste. The Incident itself, for example, may have a title or description which does not match the Result I'm investigating... or the Result I wish to view does not have a Causality Chain.
The workaround is to right-click the Result and 'Copy entire row', then I can paste into Notepad and grab the detail I need. It's a little clumsy, but it works.
Could each artifact which appears in this window have a tool which would allow 'copy to clipboard'? SHA256 already has such a tool available. Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.
... View more
01-20-2023
05:36 AM
This may serve as a good example of a single alert we've received. I'm not saying all alerts look like this, because many do not. But when they do, well... it's interesting to parse. You hope that the bulk of detail is "false positive" or "other" in your resolution.
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks