About BillyeMoore

%userprofile% not %userprofile ... View more

I know how to do it, Check point has a much better solution even on r77.30. At least spit out the updates and give the ability to review the updates and put those we do not need in a holding spot / review bucket or something else to address later.  ... View more

For that reason pretty much. Appid's need a differnet process for review than do Threat, AV and WF do not need much review at all and they have their own update.   Also would help to break out vulnerability and spyware separate and have a selection method for what gets pushed instead of managing by exception. ... View more

There are a few sites out there that will test it for you from the Internet IN.   Or go out and find an EICAR - eicar.org ... View more

Risk 1 through 3 from their trust to untrust zones is not a great way to allow traffic to the Internet. There are 58 pages of applications when I look at this on my firewall.   I found this out the hard way when someone set this up for our guest networks and we had a big netbios attacks launch from a rogue machine on our network.   Whittle it down to what you actually need.       ... View more

User ID and AD Groups is how we do it.  The rule look like this take for example SSL only   NAME, SRC Zone=GlobalProtect, Source Address=IP Range of the GP Clients, Src User: DOMAIN\Group name, DestZone= Internal, Dest Address = Group things they need to access, Application=SSL, Service = Port if necessary.  ALLOW     ... View more

I am looking for more information and found the following for DNS, this is good stuff. https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454   1)  The DNS list comes out daily and the IP lists come out daily - is there any overlap or is this IP list specifically only the things out there that do not have a DNS or Domain Name. 2) What are the High Risk IP Address List ? I see the note on the description is that just a IP addresses from other lists that are not in your Malicious list. I am trying to decide if it should be blocked. We will assume the Known Malicious IP Addresses are bad and block those.   Is there a good detailed list of links I can look at for DNS ( AV and Wildfire) as well as the IP lists? ... View more

I wish I had time to utilize all the CBT training resources available and build a cheap lab.   cbt nuggets  - good source of basic training Udemy has some great training as well and it is cheap and easy to follow.    Access to a long term demo vmware version of PANOS for training would be helpful, I know we can get these through our sales channel but would love to get a good usable free VM to use with all options and limited connectivity.    Also I came from a networking background but hear stories of information security folks who do not and they have problems learning the networking basics. The ACE is decent but needs more teeth and something like network + or CCNA type certs should be required..      ... View more