About John.Petrucci

John.Petrucci · ‎10-02-2020

It's difficult to justify deploying this product in production without support for high availability. Is this someone's side project, or a bonafide Palo Alto product?

John.Petrucci · ‎09-15-2020

Replying to myself here... Per this thread, it looks like my initial assumption was correct: https://live.paloaltonetworks.com/t5/custom-signatures/need-help-with-creating-signature-for-pop3/m-p/74176 ...So is there any way to search the payload of a TCP datagram of a known application - but an application lacking a pre-built Context? I think we need a Context called "raw-req-tcp-payload". I find it hard to believe that PAN would assume that someone who goes to the trouble of creating a custom vulnerability signature would only do so for traffic that is not classified as a known application. In fact, these are the type of people who will also go to the trouble of creating a custom application signature to eliminate unknown-tcp from their environment.

John.Petrucci · ‎09-15-2020

I'm trying to write a custom threat signature. The pattern matches just fine if I send it using netcat, but it does not match the actual application traffic. I believe that this is because the actual traffic is processed and detected as a known application, whereas the signature Context is "unknown-req-tcp-payload". Is this context only for traffic that is application = unknown-tcp? If a known application is detected, does "unknown-req-tcp-payload" not apply?

John.Petrucci · ‎01-27-2017

Do you know why that is? What is it about DNS proxy that reduces matches against Suspicious TLS Evasion?

John.Petrucci · ‎01-19-2017

This signature seems a little too trigger happy. I see it get detected frequently. What constitutes a "suspicious TLS evasion"?

Member Since	‎09-08-2015 12:09 PM
Date Last Visited	‎08-25-2023 11:36 AM
Posts	23
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎08-25-2023 11:36 AM

About John.Petrucci

Re: Minemeld High Availability

Re: Custom threat signature- search full TCP payload of any AppId

Custom threat signature- search full TCP payload of any AppId

Re: Suspicious TLS Evasion Found

Re: Suspicious TLS Evasion Found

Re: Suspicious TLS Evasion Found

Re: Custom threat signature- search full TCP payload of any AppId

Suspicious TLS Evasion Found

Re: Minemeld High Availability

Re: Custom threat signature- search full TCP payload of any AppId

Custom threat signature- search full TCP payload of any AppId

Re: Suspicious TLS Evasion Found

Re: Suspicious TLS Evasion Found