About gafrol

gafrol · ‎06-25-2018

Thank you, very helpful info. 73 Roland

gafrol · ‎06-14-2018

When is the Agent Unique ID generated and under what circumstances does it change ?

gafrol · ‎07-07-2017

Ohh woowww, the first content update to the LA Module after months ... finally Lets check it out 🙂

gafrol · ‎03-07-2017

My concern is not about WF analysis, my question is about too many false positives with the local analysis module. I would like to know what your experience is with LA. I was attending the SE Summit in Vegas two weeks ago and it seems I am not the only one feeling some pain with LA... Also the last two recent content updates did not contain an updated (trained) machine learning algorithm for the LA module.

gafrol · ‎02-21-2017

Really no one ..?

gafrol · ‎02-16-2017

182.255.5.201/~bemkmund/two/files/ne.exe You have to copy paste

gafrol · ‎02-15-2017

asking for experience with the local analysis module. As a Traps business Partner we experience many FP's with the local analysis module since it became available abt 6 months ago. Also the last two content updates did not include an updated local analysis algorithm. We and our customers feel a bit of a pain with the current status of that module. What's your experience ? Thanks Roland

gafrol · ‎02-15-2017

I just had a sample which was uploaded from ESM to WF. The analysis of WF showed an overall verdict of Malware even though static and dynamic analysis both are showing a benign verdict. I opened a case with TAC to clarify how this can be. Obviously with the newly designed WF there is a new machine learning alogorithm verdict which is currently not displayed in the WF Report. This verdict was Malware and therefore the overall verdict was Malware as well. Just to let you guys know should you stumble across the same issue. Cheers Roland

gafrol · ‎02-15-2017

Absolutely, we provide MineMeld as a Service (running in our Datacenter) to our PAN FW customers. So a commercial certificate is a must. It is working like a charm now . Rgds Roland

gafrol · ‎02-14-2017

You see the URL in my previous post..

gafrol · ‎02-14-2017

Maybe I misunderstand something but we have made up an EDL from vxvault (URL List). We have configured this EDL to be blocked in the URL Profile. This URL Profile is then being used in the FW Security Policy. But is seems access to the URL's in the list does not get blcoked we can still access them and it does not get blocked by the FW. For example 182.255.5.201/~bemkmund/two/files/ne.exe We have double checked above URL and it is in the EDL List. Any ideas ? Thanks Roland

gafrol · ‎02-14-2017

We will provide MineMeld as a Service for our PAN Firewall customers. Therefore it would be nice to see a graphical presentation of the currently connected Firewalls and to which feeds. Thanks Roland

gafrol · ‎02-14-2017

We are using an official certificate for our MineMeld install. Just had to add the intermediate SSL cert to the Cert Profile. Now it is working. thanks Roland

gafrol · ‎02-09-2017

I am having diffilculties with the Certificate Profile. In the System logs I see an error regarding the EDL Server authentication being failed. "Reason: unable to get local issuer certificat" I already created a CertProfile with the CA Cert of the MineMeld Server. Configured my EDL with the appropriate Cert Profile. Am I a missing something ? Thanks Roland

gafrol · ‎10-01-2015

What about Splunk and the PAN Splunk App ?

gafrol · ‎07-29-2015

Interesting approach thank you. I will give it a try.

gafrol · ‎07-29-2015

Still does not solve the Tunnel remote Peer IP Problem. Cannot have multipath routes to same remote peer IP at the same time, except for PanOS7 and ECMP. I guess we need to have a second remote Peer IP Address in order to have both tunnels up at the same time.

gafrol · ‎07-28-2015

Hi all, I cannot find an easy solution to this problem of having an automatic failover once the primary VPN tunnel goes down. Goal is to have both Tunnels up and runnig at the same time, once the primary VPN tunnel dies it will automatically use the other remaining backup tunnel. Remote Peer IP (195.186.255.x) stays the same for both tunnels. Currently the VPN is up and running through the Primary VPN Path only. Any ideas ? Thanks Currently there is one VR with a static route to 195.186.255.x via SC Router 1. The LAN behind VPN EP Cisco is routed into Tunnel.1 interface.

gafrol · ‎06-10-2015

Extract the file from the Zip and upload it to WF.

gafrol · ‎06-10-2015

WildFire Grayware Verdict

gafrol · ‎03-10-2015

As already said, if the macro is malicious (exploit vulnerabilty on the endpoint) then most probably Traps will stop it from happening. I made a short video to demo Traps preventing an endpoint from being exploited by a vuln. in Adobe Flash just to give an idea. Traps - Advanced Endpoint Protection by Palo Alto Networks - YouTube One of the key advantages of Traps is that it does not require any remediation after prevention, although the malicious files should get deleted/quarantined on the endpoint once a legacy AV solution has a signature....

gafrol · ‎03-10-2015

I am having a problem with IPSec (Satellite Device) as already reported. Downgrading to 6.1 resolved the IPSec problem.

gafrol · ‎03-10-2015

Just wanted to let you know https://www.sans.org/reading-room/whitepapers/auditing/palo-alto-firewall-security-configuration-benchmark-35777

gafrol · ‎12-24-2014

In my initial Post it says that the WF signature was released on 2014-11-13 05:04:03 (Timezone unknown...) Can you clarify ? Apart from the glitch experienced by Wildfire Cloud in November as mentioned above, you may experience situations in which a signature is not created automatically, specially with PE files. If that's the case, I wish there was some sort of notification in the WF report. Since today is Christmas Day in my country there are some more wishes regarding WF report - Add Date and Time of initial Release of the coverage - Add Last Update Time and Date of the same - Add Timezone Information to the Time stamps and display it according the timezone information in the User settings of the WF Portal This would add some transparency and avoids confusion. Happy Holidays Roland

gafrol · ‎12-22-2014

After three weeks they found out they had some maintenance tasks running from Nov.8 - Nov. 10.which delayed the signature creation for 8 hours....

gafrol · ‎11-13-2014

I already opened a case two days ago, no answer so far. Seems to be difficult to answer this one .... BTW where are all the release notes for the WF signatures ? On the PAN FW's I only find the two most recent WF RN's.... This does not add any transparency for customers at all. Also what is the timezone given in the "Date Released" field ?

gafrol · ‎11-13-2014

The above sample was neither a false positive nor an incorrect verdict. It is clearly malicious and as such identified by Wildfire. It took more than 24 hours to have a WF signature ready for deployment. This is not an exception, I observe many of these "delayed" WF signatures, which is a rather strong deviation from what is promised by Marketing.

gafrol · ‎11-13-2014

Can someone share some facts about the process of the WF signature creation. It was promised by PAN to have a signature ready after 15Mins. a sample has been identified as malicious (Verdict Malware). My observation is that it usually takes much longer than that. We do have a WF subscription. Example in the screenshot below.

gafrol · ‎10-05-2014

https://www.youtube.com/watch?v=aXkm55t2h_k

gafrol · ‎10-03-2014

Traps Agent on Endpoint Traps in action And the same Event in ESM

Email	roland.gafner@omicron.ch
Date Registered	‎08-16-2010 02:35 AM
Date Last Visited	‎10-23-2018 05:28 AM
Total Messages Posted	332
Total Likes Received	64

Online Status	Offline
Date Last Visited	‎10-23-2018 05:28 AM

Strata

Prisma

Cortex

About gafrol