About mmelone

mmelone · ‎04-20-2020

I'm having an issue where GP HIPS appear to expire, rendering all my rules useless and the client gets blocked eveywhere I have the HIP profile enabled. It happens after an hour of connectivity and its not always consistent. It kills long term ssh/rdp sessions and it does not seem to be related to idle timeout (3hr) or max time out (12hr). Will decreasing the check time help?

mmelone · ‎04-08-2019

Couldnt log in with default creds of admin/minemeld. This worked for me after a fresh install ansible style on ubuntu 18.04. I Followed: $ sudo apt update $ sudo apt upgrade $ sudo apt install -y gcc git python-minimal python2.7-dev libffi-dev libssl-dev make $ wget https://bootstrap.pypa.io/get-pip.py $ sudo -H python get-pip.py $ sudo -H pip install ansible $ git clone https://github.com/PaloAltoNetworks/minemeld-ansible.git $ cd minemeld-ansible $ ansible-playbook -K -i 127.0.0.1, local.yml $ usermod -a -G minemeld <your user> # add your user to minemeld group, useful for development I tried this fix as noted by drewdown and it works! sudo service minemeld stop sudo -H -u minemeld /opt/minemeld/engine/current/bin/pip install pip==9.0.3 sudo service minemeld start Thanks!!

mmelone · ‎10-09-2018

Did you open udp port 4501 on the host firewall of the host running the GP client? Only with that port open on the host will you see the authentication prompt pop up from the GP client. I had to do this for SSH auth policy. The service in the auth policy will be the TCP RDP port.

mmelone · ‎10-09-2018

Are you talking about address resolutions in the logs in the monitor tab or FQDN objects in a security policy? If you set the DNS server for the firewall, it will resolve addresses in the monitor tab logs against the DNS server set in the Device Setup config area.

mmelone · ‎10-03-2018

Hi, It appears that SonicWall configs are not supported in the Expedition Migration Tool. Are there any plans to add support for this firewall vendor? Thanks.

mmelone · ‎10-03-2018

Let us know what happens. Decryption method will need to change since the certificate information in TLS1.3 is hidden. There was some breif talk at ignite18 about it. I am interested to see what comes of it.

mmelone · ‎08-31-2018

Thanks for that explaination @reaper

mmelone · ‎08-30-2018

I believe this can be done not setting a log action on a security policy, but enabling the log forwarding option. Typically i have local logs on the firewall as well as the copy send to panorama. I believe the checkbox for "log session start or end" controls the local logging while the fowarding option will do panorama or syslog.

mmelone · ‎02-11-2018

I was informed by some project managers that this is a limiatation of the current implementation of panorama and objects vs template settings.

mmelone · ‎02-05-2018

@Mike.ship and @nbilal Thanks for the good information sharing and sorry for my pervious long-winded response.

mmelone · ‎02-02-2018

@Mike.ship I also have the problem with being able to have an overall shared Cert Profile object tied to EDL objects. When the shared box is checkec on a shared EDL object, I cannot reference the Cert Profile, even with the cert profile pushed to the device template. This is using panorama. The shared cert profiles can only be used within a template. For example, a Cert Profile created as shared in Tempalte "ABC" cannot be referenced by a shared EDL object. In order for the EDL object to reference the Cert Profile, the EDL must be in ABC location. A "shared" EDL in a device group related to the template where the the shared Cert profile lives cannot see the cert profile even though the Cert Profile is shared. Only a non shared EDL can see the Cert Profile. This makes me believe shared template objects dont necessarily mean they are able to be seen by shared Device Group Objects. It makes me believe that EDL objects can only reference a cert profile that already lives on the device via it's template. It's been slightly confusing when configuring EDLs on panos8 using panorama and getting those lists/cert profiles to work accross all devices. I'm ending up having to make 3 seperate EDLs of the same list for my 3 differeny vSYSs of one device. Those vSYSs device groups cannot see my Shared cert profile in the template of the devices where the 3 vSYSs are. Maybe I'm configuring things wrong or that is just how it's designed.

mmelone · ‎10-19-2017

FYI: If you run apple enterprise connect or other AD password syncing tools on mac: Mac systems running macOS High Sierra in your organization may be impacted by an issue that prevents Active Directory password changes from working properly. You may be impacted if Mac systems in your organization meet both of the following criteria: Mac systems are bound to Active Directory Users log into their Mac systems with Active Directory accounts (mobile accounts) If you are impacted by this issue, changing your Active Directory password will appear to succeed, but the password will not be changed. If your users log into their Mac systems with local accounts (not mobile accounts) they will be unaffected. Any tools that can change the password for an Active Directory based mobile account will be affected. This includes Enterprise Connect and the Users & Groups System Preferences pane. This issue will be fixed in an upcoming macOS High Sierra update.

mmelone · ‎10-18-2017

Traps 4.1.1 for MAC has 10.13 support.

mmelone · ‎10-18-2017

Looks like Traps 4.1.1 has included support for 10.13 High Sierra

mmelone · ‎10-13-2017

In my experience, I have found that shortening the agent heartbeat time from 60 min to 10 or 15 gives you better metrics on who is connected. It also provides quicker policy pushes and agent upgrade actions (if you use ESM to upgrade instead of SCCM).

mmelone · ‎09-12-2017

You pretty much got it. Stop IIS and Endpoint Security Manager (cyveraserver) services. Backing up the database and snapshotting the server are good practices. Pretty sure you don't need a reboot. I've based my upgrade procedures off this article and I've had nothing but good results: https://live.paloaltonetworks.com/t5/Endpoint-Articles/System-upgrade-best-practice/ta-p/75400

mmelone · ‎08-25-2017

We deployed Traps 4.0.0, 4.0.1, 4.0.2, and 4.0.3 to MacOS machines enrolled in Jamf. We have not run into issues you are discribing since we don't have any custom bash scripts for unix executables. Could you Catelog all of your hashes of your custom executables? Whitelist in hash control? Are you saying you're getting no security alerts from ESM?

mmelone · ‎08-21-2017

It seems that installing 19-1532 content version only gives benefits for Traps 4.0.3 from looking at the release notes. https://downloads.paloaltonetworks.com/traps/Traps_Content_Release_Notes_-_Version_19-1532.pdf?__gda__=1503369563_cb46e68e016cc76c57e30ebd9361167b

mmelone · ‎07-25-2017

Thanks for the info BPry. I also had a feeling something will be ready once High Sierra is avalible to the general public audiance.

mmelone · ‎07-19-2017

We have a couple developers who Upgraded to the 10.13 closed beta. According to Traps ESM 4.0.1, it's reporting that macbook's traps agent as incompatible. I was wondering what the timeline is for there to be a compatible MacOS Traps Agent for High Sierra (10.13.0). Thanks!

mmelone · ‎05-19-2017

Right. I got this from support and it Fixed my issue once mac traps agents checked in. "We've been able to confirm that Apple has blocked all injection to iTunes as a security measure. As a workaround, please first create a condition, then a policy as follows: Settings > Conditions 1. Add a condition for Mac OS 2. Name condition for iTunes > 12.6.0 3. Bundle ID: com.apple.iTunes 4. Version: > 12.6.0 This condition will be enacted if iTunes higher than 12.6.0 is installed on the machine. Policy > Mac > Add 1. Disable Dylib Hijacking and ROP Mitigation modules. 2. In the conditions tab, select your new condition and apply." This should also be addressed in the next content version.

mmelone · ‎05-16-2017

Hi, I have a weird error on a manger's machine when he tries to start Itunes. It also happens on my macbook. It looks like the /Library/Application Support/PaloAltoNetworks/*/ libmodule.dylib is blocking iTunes from opening. There is no Security Event reported to ESM. He is running Mac OS 10.12.5 and im on 10.12.4 Is there a way to make an exception for this when there is no actual ESM traps alert? Process: iTunes [14740] Path: /Applications/iTunes.app/Contents/MacOS/iTunes Identifier: com.apple.iTunes Version: 12.6.1 (12.6.1) Build Info: iTunes-1200012006001025~3 Code Type: X86-64 (Native) Parent Process: ??? [1] Responsible: iTunes [14740] User ID: 20925 Date/Time: 2017-05-16 10:21:54.280 -0500 OS Version: Mac OS X 10.12.4 (16E195) Report Version: 12 Anonymous UUID: 8FF28F2B-0356-56D9-F764-975399B8737A Sleep/Wake UUID: 9B70AC37-2755-4929-8165-94D0CF1C8651 Time Awake Since Boot: 380000 seconds Time Since Wake: 320000 seconds System Integrity Protection: enabled Crashed Thread: 0 Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Exception Note: EXC_CORPSE_NOTIFY Termination Reason: DYLD, [0x5] Code Signature Application Specific Information: dyld: launch, loading dependent libraries Dyld Error Message: Library not loaded: /Library/Application Support/PaloAltoNetworks/*/libmodule.dylib Referenced from: /Applications/iTunes.app/Contents/MacOS/iTunes Reason: no suitable image found. Did find: /Library/Application Support/PaloAltoNetworks/*/libmodule.dylib: code signature in (/Library/Application Support/PaloAltoNetworks/*/libmodule.dylib) not valid for use in process using Library Validation: mapping process is a platform binary, but mapped file is not /Library/Application Support/PaloAltoNetworks/*/libmodule.dylib: code signature in (/Library/Application Support/PaloAltoNetworks/*/libmodule.dylib) not valid for use in process using Library Validation: mapping process is a platform binary, but mapped file is not Binary Images: 0x10c0cb000 - 0x10d9d6fef com.apple.iTunes (12.6.1 - 12.6.1) <9FF40F8E-75C3-35DD-A7B2-FF7D5C85C625> /Applications/iTunes.app/Contents/MacOS/iTunes 0x10ddc2000 - 0x10de46ff7 com.apple.iTunes.iPodUpdater (12.5.0 - 12.5.0) <6B0DDCFB-E2B9-3571-9367-4F3B051865D3> /Applications/iTunes.app/Contents/Frameworks/iPodUpdater.framework/Versions/A/iPodUpdater 0x10ded1000 - 0x10ded6ff3 com.apple.PIP (1.0 - 50.2) <27DB5780-10CE-3CDA-A363-AB9BD02098DC> /System/Library/PrivateFrameworks/PIP.framework/Versions/A/PIP 0x10dee3000 - 0x10e0a4fff +libgnsdk_dsp.3.06.1.dylib (3.6.1) <EC2BBC33-8463-3C4A-BFF7-3A66DDC8D2BF> /Applications/iTunes.app/Contents/Frameworks/libgnsdk_dsp.3.06.1.dylib 0x10e0bf000 - 0x10e217ff7 +libgnsdk_manager.3.06.1.dylib (3.6.1) <F71695A1-CB46-372F-A8DE-2EFCD9A06767> /Applications/iTunes.app/Contents/Frameworks/libgnsdk_manager.3.06.1.dylib 0x10e2d9000 - 0x10e325ff7 +libgnsdk_musicid.3.06.1.dylib (3.6.1) <2D7CA505-0F66-3528-AE7C-719B58B827F9> /Applications/iTunes.app/Contents/Frameworks/libgnsdk_musicid.3.06.1.dylib 0x10e3bd000 - 0x10e408fff +libgnsdk_submit.3.06.1.dylib (3.6.1) <D302DD68-8BB0-3FA1-8C16-75D4C08EABC2> /Applications/iTunes.app/Contents/Frameworks/libgnsdk_submit.3.06.1.dylib 0x110fd9000 - 0x111016dc7 dyld (433.5) <8239D0D7-66F6-3C44-A77F-586F74525DA3> /usr/lib/dyld 0x7fff773de000 - 0x7fff773e2ffb com.apple.agl (3.3.1 - AGL-3.3.1) <EEB77D74-9B6B-331F-B103-5A62A029BCE2> /System/Library/Frameworks/AGL.framework/Versions/A/AGL 0x7fff773e3000 - 0x7fff775a4fff com.apple.avfoundation (2.0 - 1187.36) <474E9FF4-4A97-3D48-8D4F-46FD3CADBBD6> /System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation 0x7fff77648000 - 0x7fff77711ff3 com.apple.AVKit (1.1 - 356.12) <BB0FC855-987B-3B02-8940-9CF13E862539> /System/Library/Frameworks/AVKit.framework/Versions/A/AVKit 0x7fff77712000 - 0x7fff77712fff com.apple.Accelerate (1.11 - Accelerate 1.11) <E559CE70-1A9A-3C5C-9FB7-C51FDF82F03C> /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate 0x7fff786f0000 - 0x7fff794c9ffb com.apple.AppKit (6.9 - 1504.82.104) <C295FF09-9984-34C3-953B-B263EF2107AB> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit 0x7fff794db000 - 0x7fff794dbfff com.apple.ApplicationServices (48 - 48) <847E54B5-DEA4-3B50-93CE-4FC67789F179> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices 0x7fff799fc000 - 0x7fff79c08fff com.apple.audio.toolbox.AudioToolbox (1.14 - 1.14) <6EEF498D-8233-3622-B34B-49FDD9D4DF14> /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox 0x7fff79c09000 - 0x7fff79c09fff com.apple.audio.units.AudioUnit (1.14 - 1.14) <3D374973-8632-3F15-982C-E0508E6E5B1A> /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit 0x7fff79d72000 - 0x7fff7a14cff7 com.apple.CFNetwork (811.4.18 - 811.4.18) <9CE329E8-6177-3474-976D-F5C63FC875CD> /System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork 0x7fff7a166000 - 0x7fff7a166fff com.apple.Carbon (154 - 157) <7F6DA3B9-CAE8-3F75-B06A-CC710244970F> /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon 0x7fff7a61e000 - 0x7fff7a61efff com.apple.Cocoa (6.11 - 22) <85EDFBE1-75F0-369E-8CA8-C6A639B98FA6> /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa 0x7fff7a768000 - 0x7fff7a7f5fff com.apple.audio.CoreAudio (4.3.0 - 4.3.0) <184D9C49-248F-3374-944C-FD1A99A6B32E> /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio 0x7fff7abb3000 - 0x7fff7b04cff7 com.apple.CoreFoundation (6.9 - 1349.65) <F79384D1-FA3F-38CA-A847-B2625EBB790E> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation 0x7fff7b04d000 - 0x7fff7b6cffff com.apple.CoreGraphics (2.0 - 1070.22) <3C0EEAC8-2475-38BD-81DC-C1F7F6C8E82F> /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics 0x7fff7ba78000 - 0x7fff7ba78fff com.apple.CoreServices (775.19 - 775.19) <8AA95E32-AB13-3792-B248-FA150D8E6583> /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices 0x7fff7c1a1000 - 0x7fff7c2edff3 com.apple.CoreText (352.0 - 544.12) <1ED17C4A-9E2D-3537-8C5F-FB675492A002> /System/Library/Frameworks/CoreText.framework/Versions/A/CoreText 0x7fff7c2ee000 - 0x7fff7c323ff3 com.apple.CoreVideo (1.8 - 235.3) <AC11D5FB-C77B-34F5-B942-F698E84C229F> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo 0x7fff7c3d4000 - 0x7fff7c492ff7 com.apple.DiscRecording (9.0.3 - 9030.4.5) <88544E99-217A-33D9-8AC7-F54D2716658D> /System/Library/Frameworks/DiscRecording.framework/Versions/A/DiscRecording 0x7fff7c493000 - 0x7fff7c498fff com.apple.DiskArbitration (2.7 - 2.7) <A4DCD470-D8EA-37E9-BDCA-A2B469754C12> /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration 0x7fff7c62a000 - 0x7fff7c9d0ff3 com.apple.Foundation (6.9 - 1349.64) <49C8DA40-9E5B-33F9-B092-F50115B59E95> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation 0x7fff7c9d1000 - 0x7fff7c9fbff7 com.apple.GLKit (1.0 - 87) <1BB39C18-D067-3468-B01E-7099F98DF8D7> /System/Library/Frameworks/GLKit.framework/Versions/A/GLKit 0x7fff7cb91000 - 0x7fff7cc26fff com.apple.framework.IOKit (2.0.2 - 1324.50.21) <BA7DC917-35A9-3D1B-BBEC-ADF4495A166D> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit 0x7fff7cc80000 - 0x7fff7cddffe7 com.apple.ImageIO.framework (3.3.0 - 1599.7) <2BDE099C-94BA-390E-9CB5-6BE969532EB6> /System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO 0x7fff7d0d1000 - 0x7fff7dcd9ff3 com.apple.JavaScriptCore (12603 - 12603.1.30.0.34) <42993DA4-E18A-3A41-86F8-23A6656273F9> /System/Library/Frameworks/JavaScriptCore.framework/Versions/A/JavaScriptCore 0x7fff7fbf2000 - 0x7fff7fc00fff com.apple.opengl (14.0.16 - 14.0.16) <2970D284-D6BD-3727-AA74-2697AE676952> /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL 0x7fff7fc9d000 - 0x7fff7fde4fff com.apple.QTKit (7.7.3 - 2978.7) <4A9519EF-54D5-3537-86A9-329FAC6AB067> /System/Library/Frameworks/QTKit.framework/Versions/A/QTKit 0x7fff7fde5000 - 0x7fff8004fff7 com.apple.imageKit (3.0 - 1023) <412DD8C9-16DE-3715-9E60-76E30A9DB009> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/ImageKit.framework/Versions/A/ImageKit 0x7fff80751000 - 0x7fff80751fff com.apple.quartzframework (1.5 - 21) <09455972-8A33-3D61-B193-BA7E7CF984CA> /System/Library/Frameworks/Quartz.framework/Versions/A/Quartz 0x7fff80752000 - 0x7fff80952fff com.apple.QuartzCore (1.11 - 453.38) <8B771CD0-F78A-30EA-AD88-F65960528A5B> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore 0x7fff80eb9000 - 0x7fff811bafff com.apple.security (7.0 - 57740.51.3) <E8E40839-4F2C-3954-9870-9F9BA185BC81> /System/Library/Frameworks/Security.framework/Versions/A/Security 0x7fff815e5000 - 0x7fff81654ff7 com.apple.SystemConfiguration (1.14 - 1.14) <A4B97859-CB45-3910-9785-0CAF015B46BC> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration 0x7fff82f78000 - 0x7fff83323ffb com.apple.WebKit (12603 - 12603.1.30.0.34) <3D972E7D-1BC6-37CB-9ACA-AB1D81D468A0> /System/Library/Frameworks/WebKit.framework/Versions/A/WebKit 0x7fff83324000 - 0x7fff8336fff7 com.apple.AOSAccounts (1.3.1 - 63.0.6) <8597759B-0A89-32D0-8A9D-2EAD956D2A1E> /System/Library/PrivateFrameworks/AOSAccounts.framework/Versions/A/AOSAccounts 0x7fff83b2c000 - 0x7fff83b5fffb com.apple.avfoundationcf (2.0 - 247.1) <F84668A7-D090-3440-8B1D-6DB42289D8EB> /System/Library/PrivateFrameworks/AVFoundationCF.framework/Versions/A/AVFoundationCF 0x7fff8408e000 - 0x7fff840a9fff com.apple.aps.framework (4.0 - 4.0) <6CA07CDF-1E35-34E9-95BF-BD565FF42BAD> /System/Library/PrivateFrameworks/ApplePushService.framework/Versions/A/ApplePushService 0x7fff8453e000 - 0x7fff84553ff7 com.apple.BiometricKit (1.0 - 100.99) <FF3B4FA5-CE9F-31D4-81A0-3618DDE68F0F> /System/Library/PrivateFrameworks/BiometricKit.framework/Versions/A/BiometricKit 0x7fff868ee000 - 0x7fff86a2dfe7 com.apple.coreui (2.1 - 431.3) <2E8FEC10-FC5B-3782-92DA-A85C24B7BF7C> /System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI 0x7fff8a3d6000 - 0x7fff8a536ffb com.apple.MediaRemote (1.0 - 1) <5D7E9985-FB99-3F6C-87A1-73282D674590> /System/Library/PrivateFrameworks/MediaRemote.framework/Versions/A/MediaRemote 0x7fff8c6ab000 - 0x7fff8c911ff3 com.apple.SkyLight (1.600.0 - 160.40) <BA7B7ACC-1B91-3E87-92EC-1C2969EF7088> /System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/SkyLight 0x7fff8cdc1000 - 0x7fff8ce2cff3 com.apple.StoreFoundation (1.0 - 582.5) <FB02BCFA-BBE3-39A8-9EA5-718D3F3E7CAE> /System/Library/PrivateFrameworks/StoreFoundation.framework/Versions/A/StoreFoundation 0x7fff8e4c4000 - 0x7fff8e584ff7 com.apple.ViewBridge (282 - 282) <71C6F456-E63F-3465-BCC7-377D29CF817D> /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/ViewBridge 0x7fff8eaa1000 - 0x7fff8eaa5fff com.apple.iPod (1.7 - 20) <ECAAB770-8181-3B50-97DC-1F10D094B7EF> /System/Library/PrivateFrameworks/iPod.framework/Versions/A/iPod 0x7fff8edf5000 - 0x7fff8edf6ffb libSystem.B.dylib (1238.51.1) <D9B20A4F-87BC-36CB-9405-80E105666725> /usr/lib/libSystem.B.dylib 0x7fff8ef2f000 - 0x7fff8ef85ff7 libc++.1.dylib (307.5) <0B43BB5D-E6EB-3464-8DE9-B41AC8ED9D1C> /usr/lib/libc++.1.dylib 0x7fff8f4ef000 - 0x7fff8f714ffb libicucore.A.dylib (57163.0.1) <325E1C97-1C45-3A7E-9AFB-D1328E31D879> /usr/lib/libicucore.A.dylib 0x7fff8faa3000 - 0x7fff8fe75047 libobjc.A.dylib (709) <DC77AA6E-A4E4-326D-8D7F-82D63AA88F99> /usr/lib/libobjc.A.dylib 0x7fff902a1000 - 0x7fff902b2ff3 libz.1.dylib (67) <46E3FFA2-4328-327A-8D34-A03E20BFFB8E> /usr/lib/libz.1.dylib Model: MacBookPro12,1, BootROM MBP121.0167.B24, 2 processors, Intel Core i7, 3.1 GHz, 16 GB, SMC 2.28f7 Graphics: Intel Iris Graphics 6100, Intel Iris Graphics 6100, Built-In Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1867 MHz, 0x02FE, 0x4544464232333241314D412D4A442D460000 Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1867 MHz, 0x02FE, 0x4544464232333241314D412D4A442D460000 AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x133), Broadcom BCM43xx 1.0 (7.21.171.124.1a2) Bluetooth: Version 5.0.4f18, 3 services, 27 devices, 1 incoming serial ports Network Service: Display Ethernet, Ethernet, en5 Network Service: Wi-Fi, AirPort, en0 PCI Card: pci11c1,5901, IEEE 1394 Open HCI, Thunderbolt@190,0,0 PCI Card: Apple 57761-B0, Ethernet Controller, Thunderbolt@191,0,0 PCI Card: pci12d8,400e, USB Open Host Controller, Thunderbolt@194,0,0 PCI Card: pci12d8,400e, USB Open Host Controller, Thunderbolt@194,0,1 PCI Card: pci12d8,400f, USB Enhanced Host Controller, Thunderbolt@194,0,2 Serial ATA Device: APPLE SSD SM0512G, 500.28 GB USB Device: USB 3.0 Bus USB Device: Bluetooth USB Host Controller USB Device: USB 2.0 Bus USB Device: Hub USB Device: USB Optical Mouse USB Device: FaceTime HD Camera (Display) USB Device: Apple Thunderbolt Display USB Device: QuickFire Rapid keyboard USB Device: Display Audio Thunderbolt Bus: MacBook Pro, Apple Inc., 27.1 Thunderbolt Device: Thunderbolt Display, Apple Inc., 1, 26.2

mmelone · ‎05-04-2017

I was able to successfully connect after specifying Traps Ingestion Profile in the default Log Collector Group.

mmelone · ‎05-04-2017

Willian, I have already upgraded Panorama to panorama mode. It seems like port 23001 isnt open on Panorma even though i added the log collector profile and log ingestion profile from the document. https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/monitor-network-activity/ingest-traps-esm-logs-on-panorama

mmelone · ‎05-04-2017

I think i found my issue on step 4 here. Will post back with more info. https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/monitor-network-activity/ingest-traps-esm-logs-on-panorama

mmelone · ‎05-04-2017

Hi, I have Panorama 8.0.1 set to panorama mode. I'm trying to send Traps ESM logs to Panorama. I feel like my configuration is correct, but the connection fails from the Traps side. Am I missing anything? See Screenshots of my Panorama Traps Log Ingestion Profile and Traps ESM Panorama Configuration.

mmelone · ‎05-04-2017

We needed it for servers since we dont have SCOM yet but we're getting there. Thanks!

mmelone · ‎05-03-2017

Thank you Willian. I wonder if this is on the road map since most other AV/Endpoint Protection vendors offer this kind of initial install.

mmelone · ‎05-03-2017

Are there plans to be able to push new agent installations from ESM for either wordstations or servers?

mmelone · ‎01-30-2017

I have to add that I would like to see this too. A feature in traps I would like to see is simlar to sysmon. It would be nice to use the Traps Console to get visibility into any processes and services running on a specific endpoint and being able to long certain activites directly from the endpoint to the siem. Similar to ideas stated here in this slide deck from RSAcon. I know we can do a data retrieval but that process is not very intuitive and is not in real time.

Date Registered	‎06-27-2016 08:04 AM
Date Last Visited	‎07-20-2020 09:19 PM
Total Messages Posted	53
Total Likes Received	14

Online Status	Offline
Date Last Visited	‎07-20-2020 09:19 PM

Strata

Prisma

Cortex

About mmelone