This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About mivaldi
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About mivaldi
06-24-2022
739Posts
176Likes
117Solutions
Jun 24, 2022Last Visited
User
Activity
User
Profile
Latest posts by mivaldi
| Subject | Views | Posted |
|---|---|---|
| 136 | 06-24-2022 01:42 PM | |
| 184 | 06-10-2022 12:45 PM | |
| 191 | 06-10-2022 12:42 PM | |
| 253 | 06-10-2022 10:35 AM | |
| 224 | 05-05-2022 03:58 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 06-10-2022 12:45 PM | |
| 1 Like | 10-19-2021 01:55 PM | |
| 1 Like | 05-05-2022 03:58 PM | |
| 1 Like | 04-10-2018 08:28 AM | |
| 1 Like | 07-21-2021 09:59 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 33 Likes | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 04-03-2014 01:35 PM |
| Date Last Visited | 06-24-2022 05:03 PM |
| Posts | 739 |
| Total Likes Received | 152 |
06-24-2022
01:42 PM
Why do you want to report it via email?
... View more
06-10-2022
12:45 PM
1 Kudo
Also check if the misdetection began around March 15, 2022, that's when the change was pushed in Content. https://live.paloaltonetworks.com/t5/customer-resources/app-id-decoders-enhancement-plan/ta-p/469547 You can test adding ntp-non-rfc as an allowed app in your policy to see if it resolves the issue.
... View more
06-10-2022
12:42 PM
I replayed your PCAP to my lab. I see NTPv4 traffic detected as ntp-base, and NTPv1 traffic detected as ntp-non-rfc. I don't see any bittorrent traffic, but I am running 10.2.2, maybe your PAN-OS identifies it differently. Check the source ports of the sessions identified as bittorrent, and compare them to your packet capture to see if there is a correlation between NTPv1 and bittorrent, versus NTPv4 and correct identifification of ntp-base traffic. It is possible that your firewall is detecting ntp-non-rfc as bittorrent.
... View more
06-10-2022
10:35 AM
Sorry but I don't believe this has anything to do with VirusTotal either. This forum is for non-customers. The Threat and Vulnerability forum may have been a better fit, however, posts in the LIVECommunity expect answers from other Palo Alto Networks customers. If you need a response from Palo Alto Networks Support, the correct avenue for help is filing a Support ticket.
... View more
05-05-2022
03:58 PM
1 Kudo
I'm not familiar with this topic.
... View more
05-03-2022
03:18 PM
I've seen this in the past caused by issue PAN-99976, but it could be something entirely different. Please open a case with Support. You will likely need to submit the crash info file.
... View more
10-27-2021
02:23 PM
We've worked on our detection logic in WildFire to improve coverage of these samples. Thank you for reporting the issue.
... View more
10-19-2021
01:55 PM
1 Kudo
Yes, you can enable extended logging in WildFire
> debug wildfire upload-log log extended-log yes The computed SHA256 hash of files inspected by the WildFire Analysis Profile for wildfire forwarding will be written in the wildfire-upload.log log-file in the MP. To visualize it use command: > less mp-log wildfire-upload.log
... View more
09-30-2021
03:28 PM
This forum is for non customers facing false positive detections in VirusTotal. Please open a support case.
... View more
09-30-2021
11:41 AM
PAN-OS 10.0.8 is currently targeted to release mid to late October 2021.
... View more
09-22-2021
01:13 PM
2 Kudos
Sounds like a true positive. There are 105 signatures with that name so it is hard to guess which one you're getting. Please open a support ticket.
... View more
09-01-2021
10:42 AM
You can mitigate this vulnerability by having traffic that routes to the management interface be scanned by a Vulnerability Protection profile which should be set to reset-both on High severity vulnerabilities. Since the firewall does not run IPS on the traffic destined to the management *port*, the recommendation implies that you would either force management traffic through the firewall, or migrate the WebUI management of the device to a data port for in-band management (where the Vulnerability Protection profile can scan the traffic) using an interface management profile, and/or, mitigate risk by restricting access to the management port. This is covered in our documentation at https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/getting-started/best-practices-for-securing-administrative-access.html
Other than the in-band solution, a few ways to force traffic through the firewall for out of band management are to: 1) Create a Layer 3 interface in a spare data port on a separate Management Zone, associate a management interface profile to it, and define all service routes to source from this interface. Define an intrazone security policy for the Management Zone with an associated Vulnerability Protection profile to have the traffic scanned. This solution requires a single spare data port.
or,
2) Create a vWire on two data ports, connect one port of the vWire to the management port and another to your management network switch. Define a security policy for the vWire with an associated Vulnerability Protection profile to have the traffic scanned. This solution requires two spare data ports. The advantage in this scenario is that it provides true management isolation and that for any required services that do not honor Service Routes, traffic will continue to source from the Management port.
By the way, 10.1.2 and 9.1.11 have already released.
... View more
08-30-2021
10:25 AM
That's the domain of a malware site. There is a malicious JS file within that gets auto-loaded.
... View more
07-21-2021
02:25 PM
" the stateful function of the firewall will auto-permit the return traffic" this is only true if you enable DSRI in the security policy, otherwise the firewall will inspect both c2s and s2c flows.
If the user checks their personal email, the traffic will be TLS encrypted, so you need to enable SSL decryption for the firewall to inspect the file download.
The file will be inspected by the Antivirus engine and if there is a match, the file will be blocked.
If it is not a match, it is useful to have a WildFire Analysis Profile in the policy as well, so that the file will be sent to WildFire for sandboxing. It may not block the file, but at the very least, you will receive a report in your WildFire Submission Logs indicating that a malicious file that wasn't blocked has been observed in transit to the user.
If the user runs Cortex XDR Endpoint protection, and a malicious verdict was made by WildFire before the user opens the file, then there is the likelihood that you may be able to stop execution with Cortex XDR Endpoint.
Otherwise, not allowing Macros to auto-run is always a good idea.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-24-2022
05:03 PM
|
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks