About AdamCoombs

AdamCoombs · ‎02-02-2018

Hey BPry, I understand what you are saying really I do. This is task, I have been asked to do . Lot of people can bypass this really easy, by using a proxy or vpn connection etc..... Is there a good article or articles you can share show this idea is not a good one. Anything you can provide would be great. As you have help me in the past.

AdamCoombs · ‎02-01-2018

Good day everyone, I am looking for some help information with finding "Top 15 countries where cyber attacks originate" I know there are alot of blocklist out there, those have IP addresses. That is not what I am needing. If anyone can recommend websites or which countries they have blocked with the reason as well. I am looking to but together a report showing which countries would be best in blocking that active. Thank you for any help you can provide.

AdamCoombs · ‎11-21-2017

Good Day, everyone needing some help with a threat id number I can not find any information on. I am needing to do so research on this threat ID that is showing in the Palo Alto once in a while. I am wanting to change security profile setting from default on high alter to best security practices which is reset-both connections on high and critical. Anyone have any information on this one HP Intelligent Management Center TFTP Server DATA and ERROR Packets Buffer Overflow (35688)

AdamCoombs · ‎09-08-2017

Thank you BPry I started to look at the ACC yesterday I do like the option of jumping to logging with all the commands there

AdamCoombs · ‎09-07-2017

First sorry Raido I did not see you post something here. Thank you for the information. I did check the Data Filtering log I see action was allow, this traffic was filter but allow here. But since there was a reset-both action that means the file got reset on both sides so no one got infected file on there computer right ?

AdamCoombs · ‎09-07-2017

Thank you BPry Can you recommend documentation for 7.1 or videos please Adam

AdamCoombs · ‎09-07-2017

Hey jvalentine I do not use the ACC much, maybe I should look into that more. This seems to me to answer my questions about logging . With the help of Otakar.kKlier on knowing how the security profile will affect as well what i will still see in logging so be a enough to get this going

AdamCoombs · ‎09-07-2017

Hey Kaje, can you explain the more 48 delay hour option. I did not know about that

AdamCoombs · ‎09-07-2017

Good day everyone, I look to see what everyone is doing about updates for Content Apps & Threats version on the palo altos. Are you doing the auto-update or are you waiting to install it later to make sure no issues happen? If you are wanting to install it, what is are the security concerns that you came up with ? What are the productions concerns on waiting to install updates?

AdamCoombs · ‎09-06-2017

Well, sorry I will explain more on why I would not want to see the traffic that is high that I add execptions listed after change the security profile and setting that security profile to a group profile. There is traffic that is showing in the monitor threat area as high, I know this traffic is required for business to run plus it the traffic is going cross zone. I was thinking it would be better when I am monitor threat logs to see traffic that I need to do research in to make sure that is business approved traffic. Also it will clean up a lot of traffic that is not need to be seen in my thinking.

AdamCoombs · ‎09-06-2017

Thank you Otakar.klier Is there a way to make those expections not show up in the monitor threat logs?

AdamCoombs · ‎09-05-2017

Sorry for the late reply When you use policy that is blocking offending IP for a hour, can you still see the traffic in the Threat monitor logs ?

AdamCoombs · ‎09-01-2017

Ok, here is the links from the palo alto His one https://live.paloaltonetworks.com/t5/tkb/articleprintpage/tkb-id/Management-TKB/article-id/866 How to Add Exempt IP Addresses from the Threat Monitor Logs https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/create-best-practice-security-profiles search for Vulnerability Protection The goal is to when we see something that is critical and high for severity it does just alert it, it stops it by the strict profile settings. Hope this help make more sense,

AdamCoombs · ‎09-01-2017

Hello everyone question, I have been seeing this on the Threat montior area. I just need someone to verify what I am seeing is correct. This shows me that action was reset-both, which tells me file never got inside When I look at the Detailed Log View it shows something else. I am thinking that issue was not reset but file did get downloaded. If anyone can help me with this would be great. I sort this by recieved time, so what I am thinking is the file has been downloaded. Here is Type sort the same way Here is Bytes sorted the same way too Also when I look at the Destination area you can see that all is file out expected the Victim Name Help with understanding all this please.

AdamCoombs · ‎09-01-2017

Good day everyone need help with verify some information about setting strict security profile. We are wanting to set the all Security profile from default to strict to help contiune doing the best security practices recommend by palo alto. Also not wanting the logging in the threat montior to show traffic we already know is ok. So when we are monitoring threat logging it will only show issues we need to investigate. After research seeing what will be affect by this change and know that you can add expections to so that strict profile setting should not stop the traffic from contiuning. How do I verify that traffic is not being stop by the new strict security profile setting? Thank you any help would be great

AdamCoombs · ‎03-03-2017

You are right, idea was to monitor the network for users which be doing some unwanted scans. So that is why I came up with the idea of different zones with vulnerability profile. We looking into network taps devices, one is from cisco that works with ACI program that we will be getting. Thank you Santonic

AdamCoombs · ‎03-01-2017

Santonic we already use HIPS on the pc too Well best idea so far is to create a zone that is for PC so that anything that tries to cross over to any other zones will be caught. I am still going to look into a IDS system that supports L3 inspection tap Thank you all for the help with this. If anyone knows of product or service palo alto offers like this please let me know

AdamCoombs · ‎02-28-2017

santonic Span option is not going to be a option in the new upgrade, only L3 is going to be a option.

AdamCoombs · ‎02-27-2017

Well the standard setup Core 6500 series that connects firewall, IDS sensor, etc... Palo Alto has different zones for internal for different services and external zones as well. Palo Alto L3 interfaces and sub-interfaces New setup Idea nexus 9000 with ACI Palo Alto no changes since ACI does not does support SPAN or RSPAN which is use for the IDS sensor.

AdamCoombs · ‎02-24-2017

Jambulo how do you get the alerts to let you know if something is happen when you are not able to look at the screen for this traffic?

AdamCoombs · ‎02-24-2017

Well current setup on the Palo Alto do not alert on someone scanning inside the network. If I scan across zones no alert there as well, does not show up in the threat logging either. I did a test run on that nothing happen. Can you provide more infomation on your idea using 2 ports in Virtual wire? Well trying to use the PAN's so we can get rid of the old IDS that will not work with the upgrade core devices. Can you recommend a good IDS that will work with IP addresses instead of VLANS?

AdamCoombs · ‎02-23-2017

I have a idea to use the Palo Alto Firewall Vulnerability Protection Profile has a IDS sensor. Here is the idea I have what to run this by anyone. Also need help to know if this will work. Vulnerability vulenerability Protection Profile Create a Rule Rule Name: IDS Test Threat Name: any Action: Alert Host Type: ? Category: brute-force, DOS, scan create a zone for user pc and laptops create a zone for all servers and equipment then assign that profile to these zones Then using the logging from the palo alto to send it to a seim where you can setup a alert to be sent out correct people to look into this issue. Questions If a pc is scanning a bunch of other pc's will that create a alert? Reason I ask to see if this will work inside its own zone.

AdamCoombs · ‎11-28-2016

Sorry for the late reply on this. I did watch this video before posting a question, I did see it is a good idea to make sure set application. Can not setting Application be used a DOS attack, will it make the processors work harder to determined what application it is? If so could that lead to breaking Palo Alto device?

AdamCoombs · ‎11-18-2016

Hello, in the security policy that is setup. Is it best to set the application and services the same? So this will help keep that security policy safe from outside device try to see what other application can be use on that security policy. example would be a nmap script using get commands with additionals handshakes in the script, so the logging would look like zone untrust zone trust source 1.1.1.1 dest 2.2.2.2 port 80 application is portmapper action is allow you set the security policy to allow untrust zone to trust zone with application any services 80 and 443. could this be use as a DOS attack if the application is not set the same as services is?

AdamCoombs · ‎11-17-2016

That is what I thought too santonic, I need to check with someone. I did not know you could set different Fake IP address on different DNS sink profiles nice

AdamCoombs · ‎11-16-2016

I have read this information, but just wanting to verify that if I have two different palo altos devices that can route between each other that will not cause a issue. So here is a example I want to make sure will work Palo Alto A sinkhole ip address 2.2.2.2 DNS server 10.0.0.1, 10.0.0.2 Palo Alto B sinkhole ip address 3.3.3.3 DNS server 10.10.0.1, 10.10.0.2 Palo Alto A will block bad dns requested from 10.0.0.1, 10.0.0.2 and 10.10.0.1, 10.10.0.2 Same thing on Palo Alto B When I look at logs in threats area I see sinkhole on both palo alto's

AdamCoombs · ‎11-15-2016

I have a question about DNS sink hole in the corporate enivorment. If you have multiple DNS servers and multiple Palo Altos firewalls. Can you configure palo alto firewalls to work with all the dns servers? Do you have to setup each firewall with different sink hole zones or same zone? The OS is 7.1 Any help with would be great on this

AdamCoombs · ‎11-07-2016

I found this today Is this something a company would use https://benchmarks.cisecurity.org/downloads/show-single/index.cfm?file=palofirewall.100

AdamCoombs · ‎10-20-2016

I agree best practices are not always best for enivorment. Just make sure when someone reviews the configs of the firewall they are making sure things work too. Thanks for the url link I will review it as well, nothing wrong with more information

AdamCoombs · ‎10-20-2016

Can you describe what they did like, did have check list that goes with palo alto best security practices. DNS Sink check Deny ACL placement check Zone recommendations Profile not best practices Did they verify all the best security practices are in place and correct working

Date Registered	‎04-11-2016 12:06 PM
Date Last Visited	‎02-05-2019 05:48 PM
Total Messages Posted	39
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎02-05-2019 05:48 PM

Strata

Prisma

Cortex

About AdamCoombs