Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About SRA
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About SRA
07-14-2016
123Posts
21Likes
17Solutions
Jul 14, 2016Last Visited
User
Activity
User
Profile
Latest posts by SRA
| Subject | Views | Posted |
|---|---|---|
| 3021 | 07-24-2013 02:49 PM | |
| 3022 | 07-24-2013 12:40 PM | |
| 3021 | 07-23-2013 01:44 PM | |
| 3209 | 06-24-2013 11:13 AM | |
| 2135 | 06-19-2013 03:36 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 06-05-2013 04:48 PM | |
| 1 Like | 09-13-2010 06:05 PM | |
| 1 Like | 04-15-2011 05:29 PM | |
| 1 Like | 08-15-2011 05:28 PM | |
| 1 Like | 10-07-2010 07:22 PM |
User Badges
Community Statistics
| Member Since | 05-24-2010 03:26 PM |
| Date Last Visited | 07-14-2016 11:19 AM |
| Posts | 123 |
| Total Likes Received | 19 |
07-24-2013
02:49 PM
The session vs. transaction option only matters when you have multiple conditions in the signature, and you want all of those be within a single transaction, or they can occur across transactions in a session. Have you taken a packet capture of the session to check if the patterns are indeed exactly the same as you used in the signature.
... View more
07-24-2013
12:40 PM
The entire session should be blocked, not just a few packets; unless the remaining packets are part of a different session. Also, from your original post it seems like the patterns don't appear in the session in all the editions of their product. Can you confirm from a packet capture that the patterns (either a header or URI) are indeed present in the session.
... View more
07-23-2013
01:44 PM
You can build a custom vulnerability or app signature to identify this traffic. To match on patterns in http request headers, you can use the http-req-headers context, and for matching patterns in URL you can use http-req-uri-path context.
... View more
06-24-2013
11:13 AM
1 Kudo
This does not appear to be a genuine or valid scenario. The scheme devised in the test assumes both the client and server are already under the control of the attacker. We aren't aware of any real-world clients or servers that can talk DNS initially and then switch to SSH. App-ID has coverage for many evasive real-world tunneling applications and we continue to add coverage for more as we discover them. We are currently reviewing this further, stay tuned for an update.
... View more
06-19-2013
03:36 PM
That's the right query. I just tried it on my PA-200 on PAN-OS 5.0.4-h1 and it works right. Are you trying this to the device via Panorama using the target parameter?
... View more
06-05-2013
04:48 PM
1 Kudo
Have you tried using the type=import API query with curl? Check out the API guide for details. curl --form file=@ filename “http(s)://firewall/api/? type=import&category=configuration&key=xxx ”
... View more
06-03-2013
03:43 PM
That change was done in content version 375 and I definitely agree with you that it should have been listed in the content release notes. We are investigating why it missed the release notes and will try to prevent it in the future.
... View more
06-03-2013
01:57 PM
The warning message identifies application dependencies for all potential app usage scenarios. If your particular scenario does not need the dependency, you can ignore the warning.
... View more
06-03-2013
01:32 PM
When using clients to access Gmail, the outgoing mail server is smtp.gmail.com and this uses SMTP over SSL or StartTLS. This traffic will be identifed as smtp when using StartTLS or when the SSL session is decrypted. https://support.google.com/mail/answer/13287?hl=en
... View more
05-20-2013
08:47 AM
are you able to login to the firewall WebUI with those same credentials?
... View more
05-01-2013
12:15 PM
1 Kudo
Wildfire logs cannot be retrieved from the API using the 'log-type=threat' option. A new 'log-type=wildfire' option is being added for this in upcoming PAN-OS 5.0.x software update.
... View more
04-09-2013
10:58 AM
The Application Objects browser on the WebUI as well as the Applipedia page on the Internet provide free text search including searching by port numbers.
... View more
04-07-2013
01:15 PM
You can try to match on the http-rsp-headers for the content type of crl : application/pkix- crl, application/x-pkcs7-crl, etc.
... View more
04-04-2013
08:35 PM
Your usage is correct. Can you confirm the job id value you provided is the same as the one returned by the previous query.
... View more
04-01-2013
11:29 AM
See this API guide:
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-14-2016
11:19 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks
