About MichaelWrigh

Hello, I was wondering if there is any process for escalating a URL filter change? I have come across a website today called krudplug.net that was categorised as streaming media. This website contains video footage of pornography, extreme violence and injury detail including murders and people being killed in accidents. I blocked the website and requested a URL change to Adult and to my surprise this request was rejected and the categorisation kept as streaming media. I requested a URL categorisation change again this time to extremism and it was returned as a categorisation change to questionable, still not really appropriate considering the content and one that I am concerned may revert back if they don't get more categorisation change requests for it. I am presuming it is bots doing the categorisation changes rather than people, is there a way  anyone knows of to escalate this further so that the site can be further investigated? I have checked online and found no way to do this, I am considering raising this with my point of contact at Palo Alto Networks to see if they could do anything about it. ... View more

Hello, I am using DNS rewrite for a hosted service that we are connecting to, however, the global nature of this feature is causing me some problems now as we are connecting a network we do not manage to our firewall which causes routing to fail to the rewritten addresses.   One of the solutions I am considering is creating a new vsys on the firewall and using this for the rewrite, my reasoning for doing it this way is so that all other DNS traffic that does not go to this new vsys will not have their DNS entries rewritten.   However, I have a concern that moving the DNS rewrites to a separate vsys will not prevent DNS replies being rewritten in the old vsys ( due to the fact the documentation says the DNS rewrite occurs at the global level ). I understand that a separate vsys should for all intents and purposes run as a completely separate logical firewall but I am just a little concerned that this may be a scenario where it doesn't.   Any help here would be greatly appreciated.         ... View more

Hello, We are seeing what appears to be false positive detections for the PoshC2C vulnerability signatures that was released recently. Connections going to Google and BBC, is anyone else seeing the same thing here? ... View more

Hello, I have been using a header insertion to restrict login to an approved list of Google Domains for a couple of years now. However, I have now encountered an issue and was wondering if anyone else had a similar experience or has any idea what to do. On one of our domains, there is a regular but seemingly random occurrence of login failures with the error message -  Something went wrong Sorry, something went wrong there. Please try again.   When this happens on a device, it can start working correctly again afterwards with no changes being made. If I disable decryption for accounts.google.com then users can login with any account again.   Checking Chrome in developer mode shows that the connection fails going to https://accounts.google.com/_/lookup/accountlookup?hl=en-GB&_reqid=* and stalls when at the initial connection stage. Another device on the same subnet will be able to successfully connect to the above URL and thereofee be restricted to only the Google Domains we allow. Other domains we have in our organisation dont seem to have the problem, I am struggling to see a pattern that would enable me to isolate the issue. Any help would be greatly appreciated! ... View more

Hi, I am seeing a lot of traffic being identified as  malware.azjf C2 traffic over the last couple of days since the last threat update. I have noticed a pattern that users are visiting Wordpress websites that use the owl carousel plugin and checking these sites on VT they come up clean so appears to be a false positive. Is anyone else aware of this going on? ... View more