About fredallee

fredallee · ‎08-18-2014

Amber, You can create a threat exception by clicking on the name of the threat in the threat log. The pop-up window will allow you to select which security profile to add the exemption and also add an IP address if you only want to turn the signature off for a specific IP address as opposed to turning the signature off for the entire security profile. Alfred

fredallee · ‎05-16-2014

There are 2 settings. There is a file blocking profile which can be setup to alert, continue, block, or forward to WildFire for sandboxing based on file type. There is another setting for WildFire signatures under the AV profile. This setting is used to decide what you would like to do with WildFire malware signatures. If you set WildFire signatures to block, it will block on malicious files based on the WildFire signatures. WildFire signatures are updated every 30 minutes based on malware detected from all devices sending files to WildFire.

fredallee · ‎05-27-2013

The current version of the WildFire appliance does not support the API.

fredallee · ‎03-20-2013

We have released an article on DevCenter with 3 signatures to identify and control March Madness Live traffic. Here's the link:

fredallee · ‎03-19-2013

We're checking it out tonight. Thankfully there are 2 play-in games tonight which gives us a view into what the NCAA March Madness Live traffic looks like. Look out for Dev Center and KnowledgePoint articles about this tomorrow.

fredallee · ‎02-06-2013

Puffin is a cloud browser meaning that they proxy all traffic for the client to the Puffin servers via SSL. You should be able to create a custom App-ID using the hostname of the server cert cloudmosa.com.

fredallee · ‎12-06-2012

Hi Sebastian, We will take a look at this sample and get back to you. Stay tuned... Alfred

fredallee · ‎09-05-2012

We normally don't write signatures for specific URLs that end up getting inserted via SQL injection attacks, unless they are exceptionally pervasive. These are everywhere and it is impossible to cover them all. Instead we have generic SQL injection signatures that can detect many common SQL injection attempts, and customers can also write custom vulnerability signatures for specific SQL injection attacks that you may be concerned about.

fredallee · ‎07-20-2012

Yes, WildFire works the same in L3 and tap mode. I'm not sure why your setup isn't working only in tap mode.

fredallee · ‎07-17-2012

Not right now. However, we are looking at potentially adding this feature to the portal. A workaround would be to add an alias email address to your support account, and that alias would represent multiple email addresses.

fredallee · ‎07-05-2012

What is the actual signature that is being enabled behind that exception rule? Is it a custom sig or the Palo Alto Networks ftp brute force sig?

fredallee · ‎06-26-2012

You can indeed do this. In PAN-OS 4.0, a new action called block-ip was introduced. You can block based on source IP or source and destination IP pair. You can use this action in the vulnerability protection profile > Exceptions, find the signature and change the action to block-ip. Set the time from 1-3600 seconds. On the zone protection profile, you can also use the block-ip action associated with the reconnaissance protection for port scans and host sweeps.

fredallee · ‎04-24-2012

There is no secret. The default actions for vulnerability protection and anti-spyware signatures have been available on the profile either under the custom signatures or under the exceptions area (depending on your PAN-OS version). For antivirus, the default action is always set to block. We are also working on an easier and automated method to make this and other threat meta data available in an upcoming PAN-OS release. Alfred

fredallee · ‎04-08-2012

Thanks Manfred. We have also written an AV signature for it and are planning to release it tomorrow. Alfred

fredallee · ‎03-28-2012

No, the user would not see a block page for a vulnerability exploit that was detected. If a specially crafted web page contained an exploit, we would take the action associated with that signature on the profile, i.e. drop all packets and send a tcp reset to the client, server, or both, alert, etc. We don't have a block page for vulnerability protection.

Member Since	‎03-27-2009 09:15 AM
Date Last Visited	‎05-23-2022 09:02 PM
Posts	89
Total Likes Received	20

Online Status	Offline
Date Last Visited	‎05-23-2022 09:02 PM

About fredallee

Re: THREAT ALERT : high : 169.254.254.238 -> 169.254.255.255 Microsoft Windows NAT Helper DNS Query Denial of Service(31339) alert

Re: Wildfire - is the full subscription worth it?

Re: Can there be alone WF-500(Wildfire appliance) without FW?

Re: March Madness signature

Re: March Madness signature

Re: Understanding Zone Protection

Re: How is the threat severity level determined?

Re: How to disable threatID for defined IP addresses

Re: Unknown Virus

Re: Brute force and scanning signatures

Re: THREAT ALERT : high : 169.254.254.238 -> 169.254.255.255 Microsoft Windows NAT Helper DNS Query Denial of Service(31339) alert

Re: Wildfire - is the full subscription worth it?

Re: Can there be alone WF-500(Wildfire appliance) without FW?

Re: March Madness signature

Re: March Madness signature

Re: Puffin Browser: Bypassing Filtering policies (big loop hole may be ??)

Re: Is wildfire mistaken? false negative?

Re: SQL Injection Lilupophilupop (Part 2)

Re: Does WildFire work in "Tap" mode?

Re: Wildfire multiple user Email Notifications request

Re: Block FTP Brute Force Attemps - Threat ID 40001

Re: How to block people who are trying to exploid vulnabillities for a period of time

Re: Security Profile default actions

Re: PA dont catches Trojan JS.Redirector

Re: Block page for vulnerability protection

Network Security

Cloud Security

Security Operations

About fredallee