About tmyzw

Hello,   Thank you for your reply. The customer currently has two internet links, one is for G Suite and the other is for the rest. And a proxy server sits on the latter link. So their PAC file has statement kind of like "direct connect for G Suite URLs and via proxy for the rest".   What I want the customer do is to ditch the proxy server for maximum budget allocation to us. To accomplish this, two internet links are connected to our NGFW and select link based on destination URL which is eventually IP address.   We only can use FQDN object for that purpose but FQDN object doesn't support wildcard FQDN as well as FQDN includes an arbitrary number. This is why I'm looking for a way to accomplish this.   Thanks, Takahiro ... View more

Hello,   Thank you for your reply. Some documents on restoring or hardware replacement procedure mention that two platforms have to be same OS version or something like that. Is there any documents mentioning auto conversion when importing configuration file of old OS version.   Thanks,   ... View more

I don't think you can get detailed information for all of spyware IDs with single query but you can create a script to do that. Please refer my python script on GitHub for more detail. listing signature script moved to GitHub Thanks, ... View more

It worked as expected! Thank you, Takahiro ... View more

Hi, Has the URI you mentioned already been valid? I tried following command today but no luck. ------------------------------- $ curl -i -k -F device_id=001606000xxx -F report_id=417xxx -F format=xml https://wildfire.paloaltonetworks.com/publicapi/report HTTP/1.1 100 Continue HTTP/1.1 400 Bad Request Server: nginx/1.0.9 Date: Thu, 11 Jul 2013 07:22:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.3.6 ------------------------------- Also tried with wget to check if the curl I am using is something wrong but almost same result. ------------------------------- $ wget --no-check-certificate --post-data 'device_id=001606000xxx&report_id=417xxx&format=xml' https://wildfire.paloaltonetworks.com/publicapi/report --2013-07-11 08:25:46--  https://wildfire.paloaltonetworks.com/publicapi/report Resolving wildfire.paloaltonetworks.com... 54.241.16.153 Connecting to wildfire.paloaltonetworks.com|54.241.16.153|:443... connected. WARNING: certificate common name `*.wildfire.paloaltonetworks.com' doesn't match requested host name `wildfire.paloaltonetworks.com'. HTTP request sent, awaiting response... 400 Bad Request 2013-07-11 08:25:47 ERROR 400: Bad Request. ------------------------------- Any mistakes I am making? Thanks, ... View more

I made a small change. The description of threats contains comma so TAB is suitable for field separation instead of comma. Output of this script now uses TSV(Tab Separated Value). ... View more

I created version 2 of this program since I found "description" of threats provided in API as well. Please note this program gets the descriptions one by one so will take around one hour, and CPU usage of management plane could be increased. This is a special purpose program and I'd recommend to use PAN-python when you don't want to use/learn multiple programs. Thanks, Takahiro ... View more

Hi, You can use binary pattern match to detect DNS query because you already experienced that exact character without wildcard is too short to meet PA's requirement which is 7 bytes. To detect "123456.aa.us", the signature would be like this. "\x 31 32 33 34 35 36 02 61 61 02 75 73 \x" Thanks, Takahiro ... View more

Hello, I finally got an answer. All I needed was to eliminate <hip-report> tag. Here is the XML data what I submitted without response message. $ cat test.xml <uid-message><version>1.0</version><type>update</type><payload><login><entry name="user1" ip="1.1.1.1" timeout="10"></entry><entry name="user2" ip="1.2.2.2" timeout="10"></entry></login><logout></logout><groups><entry name="group1"><members><entry name="user1"/></members></entry><entry name="group2"><members><entry name="user2"/></members></entry></groups></payload></uid-message> Thank you for your advice. ... View more

Here is what I tried with wget and tweaked xml file. $ cat test.xml <uid-message><version>1.0</version><type>update</type><payload><login><entry name="user1" ip="1.1.1.1" timeout="10"><hip-report></hip-report></entry><entry name="user2" ip="1.2.2.2" timeout="10"><hip-report></hip-report></entry></login><logout></logout><groups><entry name="group1"><members><entry name="user1"/></members></entry><entry name="group2"><members><entry name="user2"/></members></entry></groups></payload></uid-message> $ wget --no-check-cert --post-file test.xml " https://172.16.22.67/api/?type=user-id&key=LUFRPT14MW5xOEo1R09KVlBZNnpnemh0VHRBOWl6TGM9bXcwM3JHUGVhRlNiY0dCR0srNERUQT09&action=set&file-name=test.xml&client=wget " --2013-01-16 10:13:52--  https://172.16.22.67/api/?type=user-id&key=LUFRPT14MW5xOEo1R09KVlBZNnpnemh0VHRBOWl6TGM9bXcwM3JHUGVhRlNiY0dCR0srNERUQT09&action=set&file-name=test.xml&client=wget Connecting to 172.16.22.67:443... connected. WARNING: cannot verify 172.16.22.67's certificate, issued by `/C=US/ST=CA/L=Sunnyvale/O=Palo Alto Networks/OU=Support/CN=localhost/emailAddress=support@paloaltonetworks.com ':   Self-signed certificate encountered.     WARNING: certificate common name `localhost' doesn't match requested host name `172.16.22.67'. HTTP request sent, awaiting response... 200 OK Length: 107 [application/xml] Saving to: `index.html?type=user-id&key=LUFRPT14MW5xOEo1R09KVlBZNnpnemh0VHRBOWl6TGM9bXcwM3JHUGVhRlNiY0dCR0srNERUQT09&action=set&file-name=test.xml&client=wget.1' 100%[============================================================================>] 107         --.-K/s   in 0s 2013-01-16 10:13:53 (4.29 MB/s) - `index.html?type=user-id&key=LUFRPT14MW5xOEo1R09KVlBZNnpnemh0VHRBOWl6TGM9bXcwM3JHUGVhRlNiY0dCR0srNERUQT09&action=set&file-name=test.xml&client=wget.1' saved [107/107] $ cat index.html\?type\=user-id\&key\=LUFRPT14MW5xOEo1R09KVlBZNnpnemh0VHRBOWl6TGM9bXcwM3JHUGVhRlNiY0dCR0srNERUQT09\&action\=set\&file-name\=test.xml\&client\=wget.1 <response status="success"><result><![CDATA[ missing user-name. missing user-name. It's same as I did in my program. ... View more