About wtobar

Hello @pdysart  the original post was from 2021, but , wich agent version do you have? the issue is just in 1 computer? Have you seen any anormal behavior in that computer?   Regards, wtobar ... View more

May you post the event (blur IP addresses and hostname/username) ?   Regards, wtobar ... View more

Hi @MarkRosenecker   That behavior is beacuse the office macro analysis is much powerful in TMS than ESM (at least on version 4.0 and 3.x). I sugest to you open the event and analyses the path and files/libraries vinculaded, then put that event on excepcion if you are completely sure that is clean or create a rule for especific host, but leave the JIT Mitagation disabled is not a best practice.   The best regards, Walter Tobar ... View more

Hello!   The uninstall password and change uninstall password are bug since traps 4.1.2 if I remember well, Thast´s looks like in the version 4.2 that will fixed, according your experience it's not. Anyway, one solution for tat issue (temporary until the bug is fixed) is: 1. Open a cmd console with administrator rights 2. move to path where your installer  3. run the command: msiexec /accepeula /x Path\Traps_x64_4.1.1.28779.msi UNINSTALL_PASSWORD=Password1 /l*v c:\uninstallLogFile.txt   NOTE: By default the uninstall password is: Password1. Using a Uninstall Policy with Password1 wolud works fine.   The version 5.x its not the same that 4.x, from the behavior to the policies, all are different, the protection is different too. I use both, ESM based for all mi internal clients and  TMS for movil users, some linux and MAC. For my personal use (for me only) the upgrade of all clients (using ESM) I prefer make it computer to computer, because one latency on the network, computer freeze, hibernation, laptop close or whatever thing could stop the installation/unistallation/upgrade and damage the agent.   I hope that help to you.   Regards, wtobar ... View more

Hi,   I'm not sure if I undertood very well, but you want to know if Traps can perform a forensic analysis, if is yes, Traps client take the events and send it to ESM, but you can create a rule on ESM  to collect forensic or files from the client.   If the issue (registry deleted) was perform when traps was enabled, you need to check your policies, first 'cause traps has the option to protect the services against malware or malintentioned actions, then second if that happend you don't have configured traps correctly.   Check Policies>Forensics, on ESM console.   The best regards, wtobar ... View more

Hi,   By default Java is monitored by suspicious or exploitation behavior, by default traps enable a rule for java like as another process, please check the reputation of those files (.exe) and if someone else are trying to use them.   Regards, ... View more

Hi @sbessat I just check my security alerts and saw only 4 events starting on jan about that issue, but for network latency, I use 4.1.2 version on ESM and some agents, may you requiere submit case to paloaltonetworks support if your events are continues or higher.   Regards, wtobar ... View more

Hello @sbessat!   I saw that event in my console, but in my case that happend when my network has some latency but that not impact in agents protection.   Regards, wtobar ... View more

Hello,   I found those files in my computer when I perform on-demand scan with my AV, using CMD I couldn't find them, but using Power Shell that was possible, then I asked to support for that, the answer:   "those files are a tramp injected by paloalto traps, that works when is a new ransomware, the ransomware try to encrypt the files and traps catch it and block the ransomware."   So I put that concept on the run in effect, traps stop the action. Please look at the picture attached. Regards, wtobar ... View more

Hello,   Traps its a good choice, I have more than one year, in my opinion is an excellent protection, I'm planning to migrate at 4.x version for the next month. For the false positives use the monitoring mode, then create the rules, once the rules are created believe me the platform works fine. To deploy use a GPO policie.   Regards, wtobar ... View more

Hello,   I try to send agent upgrade from ESM, but logon script worked well for me. Regards, ... View more