About JamesChim

@riwang  Did you ever see the traffic logs? OR Traffic logs stopped showing up in GUI? Run this command from CLI   show log traffic direction equal backward   If you see logs on the CLI then it is GUI issue. Also Run this command to see if Traffic Log counter is incrementing or not?   debug log-receiver statistics Logging statistics ------------------------------ ----------- Log incoming rate: 12/sec Log written rate: 13/sec Corrupted packets: 0 Corrupted URL packets: 0 Corrupted HTTP HDR packets: 0 Corrupted HTTP HDR Insert packets: 0 Corrupted EMAIL HDR packets: 0 Logs discarded (queue full): 0 Traffic logs written: 162985 GTP logs written: 0   Regards   ... View more

Take a look at this other livecommunity post here with an alternative source as well as direct URLs for those links used in the original appspot source:   https://live.paloaltonetworks.com/t5/minemeld-discussions/panwdbl-appspot-com-unaccessible/m-p/32058...   Direct URLs that the appspot source was referencing or equivalent source: Type Name URL Notes IP List Tor Exit Nodes https://www.dan.me.uk/torlist/?exit Grab every 30mins IP List Known Compromised Hosts https://rules.emergingthreats.net/blockrules/compromised-ips.txt   IP List Malware Domain http://www.malwaredomainlist.com/hostslist/ip.txt   IP List SpamhausDrop http://www.spamhaus.org/drop/drop.txt   IP List SpamhausEDrop http://www.spamhaus.org/drop/edrop.txt   IP List BruteForceBlockerList http://danger.rulez.sk/projects/bruteforceblocker/blist.php   IP List DsheildBlockList http://feeds.dshield.org/block.txt   IP List SSLAbuseIPList https://sslbl.abuse.ch/blacklist/sslipblacklist.txt   IP List FeodoTrackerBadIPsList https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt Dridex, Heodo (aka Emotet) and TrickBot botnet command&control servers (C&Cs) IP List TalosIntelIPFilter https://www.talosintelligence.com/feeds/ip-filter.blf Exceeds EDL URL length URL List URLHaus Malware URLs https://urlhaus.abuse.ch/downloads/text_online/ Dynamic URLs that are online ... View more

So does this mean, when we migrate from PA-3020 to PA-3220 we dont need to use Expedition? We can directly import the config file if both PA-3020 and PA-3220 are running on same PAN-OS? ... View more

Please follow the KB to set uninstall password, https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/customizable-agent-settings/add-agent-settings-profile   STEP 7. Define and confirm a password the user must enter to uninstall the Cortex XDR agent. The uninstall password is encrypted using encryption algorithm (PBKDF2) when transferred between Cortex XDR and Cortex XDR agents. Additionally, the uninstall password is used to protect tampering attempts when using Cytool commands.   The default uninstall password is   Password1    A new password must satisfy the following requirements: Contain eight or more characters. Contain English letters, numbers, or any of the following symbols:   !()-._`~@#"' .   ... View more

you are welcome. Make sure the option " Stop Traffic when LogDB full" is disabled you can find it in (Device > Management > Logging Settings > Log Export and Reporting", because by defualt the firewall overwrite old traffic when Storage is full. ... View more

I also just checked seems those applications are not there. As per PA documents   Application-specific rules are not recommended for use with PBF . Whenever possible, use a service object, which is the Layer 4 port (TCP or UDP) used by the protocol or application. So only option now is based on Destination IP address. ... View more

@JamesChim  We also have few onsite spare at our environment. We are responsible for  that. ... View more

Hi @danilo.souza,   left a response in https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Share-level-Yellow/m-p/223219/highlight/true#M2408 ... View more