This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About KiCheonLee
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About KiCheonLee
02-25-2018
11Posts
1Like
0Solutions
Feb 25, 2018Last Visited
User
Activity
User
Profile
Latest posts by KiCheonLee
| Subject | Views | Posted |
|---|---|---|
| 4590 | 02-07-2018 08:27 PM | |
| 4980 | 01-29-2018 01:56 AM | |
| 4099 | 01-28-2018 11:34 PM | |
| 4114 | 01-28-2018 07:21 PM | |
| 1689 | 11-20-2017 05:20 PM | |
| 1702 | 11-10-2017 12:21 AM | |
| 1716 | 11-08-2017 09:06 PM | |
| 4228 | 07-21-2017 01:35 AM | |
| 1786 | 05-23-2017 03:32 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 07-21-2017 01:35 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 01-22-2017 10:08 PM |
| Date Last Visited | 02-25-2018 09:09 AM |
| Posts | 11 |
| Total Likes Received | 1 |
02-07-2018
08:27 PM
@xhoms
Thanks a lot for your assistance.
I was glad to discuss with you and it was so helpful.
Have a great day.
... View more
01-29-2018
01:56 AM
Hello
Here is a qurery about last 30days.
I just would like to change started date/time automatically when Minemeld do the query.
{"operator":"all","children":[{"field":"sample.malware","operator":"is","value":1},{"operator":"all","children":[{"field":"sample.create_date","operator":"is","value":["2017-12-31T00:00:00","2018-01-29T23:59:59"]}]}]}
Please let me know it
... View more
01-28-2018
11:34 PM
Hi @xhoms
Thanks for your reply and advise.
I saw the document and checked it before you wrote the link. But it didn't work.
But I checked it again from step 1 after all configuration was removed. It works well.
Have a good day.
... View more
01-28-2018
07:21 PM
Hello,
I can't get IPs from output of minemeld in autofocus.
Please refer to the follwoing message and then give me any assistance.
I can see IPs when I enter the follwoing url on a browser.
https://0b2b72a3.paloaltonetworks-app.com/feeds/feedMCWithValue-Malware-IP
vsys1/ActiveCampaignsIPv4: Next update at : Mon Jan 29 12:03:25 2018 Source : https://0b2b72a3.paloaltonetworks-app.com/feeds/feedMCWithValue-Malware-IP Referenced : Yes Valid : Yes Auth-Valid : Yes Total invalid entries : 1 Valid ips: Invalid ips: Unauthorizedweb
$//g' /opt/pancfg/mgmt/devices/localhost.localdomain/vsys1_ActiveCampaignsIPv4.ebl.tmpxx 2>/dev/null > /opt/pancfg/mgmt/devices/localhost.localdomain/vsys1_ActiveCampaignsIPv4.ebl.tmpCampaignsIPv4, 1, 1 ip) calling /bin/sed -e 's/ 2018-01-29 11:58:57.816 +0900 EDL entry(0x160e000, 0x182c6800, 0x7100400 vsys1/ActiveCampaignsIPv4, 1, 1 ip) Downloaded EDL file size(1036) 2018-01-29 11:58:57.880 +0900 EDL entry(0x160e000, 0x182c6800, 0x7100400 vsys1/ActiveCampaignsIPv4, 1, 1 ip) Valid entries(0) lines skipped(1) 2018-01-29 11:58:57.890 +0900 EDL entry(0x160e000, 0x182c6800, 0x7100400 vsys1/ActiveCampaignsIPv4, 1, 1 ip) No valid ips found in list file 2018-01-29 11:59:07.988 +0900 client device reported Phase 1 was SUCCESSFUL 2018-01-29 11:59:08.139 +0900 EDL entry(0x160e000, 0x182c6800, 0x7100400 vsys1/ActiveCampaignsIPv4, 1, 1 ip) Refresh job success 2018-01-29 11:59:08.189 +0900 EDL FREE EDL Refresh timer job (0x9df6d00, 2096) 2018-01-29 12:00:00.178 +0900 Checking to purge appstatdb logtype
... View more
11-08-2017
09:06 PM
My customer uses GP Internal Gateway with a non-Tunnel mode. It means it uses just only user authentication and enforces user-based rules. I am facing an issue . A user was connected to GP Internal GW in office 1F and successed authentication. The FW was updated A user has 192.168.1.1 from GP. The user moves to 2F and changed IP from 192.168.1.1 to 192.168.2.1. The user still reaches Internal GW but the FW still hold A user has 192.168.1.1 . Therefore, The user can't be enforced by his user based rules. Finally, the user's traffics were blocked by the latest rule as any any block. I am expecting there would be two ways that could resolve the issue. One, If GP Agent could update changed IP to the FW, this issue would be resolved. But I am expecting that could not update because using non-tunnel mode. Do you have another way of updating changed IP to the FW? If you have, Please let me know. Another way, If GP could disconnect when it senses ip changed, this issue would be also resolved. Because users must do authentication again and the GP agent will update IP-User mapping information to the FW. Do you have another way of disconnecting GP when PC is changed another IP? If you have, Please let me know. And do you have other ways else? please let me know. It would make me helpful. Thanks, KC Lee
... View more
07-21-2017
01:35 AM
1 Kudo
Hello, I built the sandwich type with external ELB & internal ELB. As you know, external ELB shifts original client IP to X-Forwarded-For. I enabled 'Use X-Forwarded-For Header in User-ID and I looked XFF IP in user-id of URL Filtering logs. But PA has not shown XFF IP in traffic logs. I would like to block XFF IP using user-ID. If anyone knew it, Please let me know it. Thanks, KC Lee
... View more
05-23-2017
03:32 AM
Hello, I got virus sample files for Cylance POC from virusshare.com and malshare.com . Theses files are named by hash(sha256 or MD5) I attached exe extension to them But it looks like they do not run. I would like these files can run on my VM. Please let me know how to run it.
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks