About LeeFrancis2

We are investigating alerts of this DNS signature for   x1.c.lencr.org. I'd expect that a match for a clear text string in a DNS Request that it is very unlikely this is a false detection. However to get alerts so quickly after this signature creation, suggests we are either very unlucky or  a very common public internet resource if causing this fly-by access. Anyone else receiving this threat alert shortly after an apparent WF update. KR, Lee   ... View more

Hi Live community, recently when investigating a false positive C&C threat blocked from "shodan malware hunter" I was pleased to see others had posted into this community about this. In the past 24 hrs we have 2 SIEM alerts for C&C outside to publically presented hosts from 45.9.148.91. Anyone else seeing this behaviour ? PAN did reset both but I am considering a block rule, but of course the src IP could change at any time. IP is on some blacklists: xbl.spamhaus.org   has  blacklisted this IP. zen.spamhaus.org   has  blacklisted this IP. and appears to slowly, be carrying out reconnaissance on our public IP space.   KR, Lee   ... View more

The PAN docs and the Panorama GUI 'panorama -templates' page all seem to imply the stack is a container for a hirearchical list of templates. So that only the templates contain configurations items.   At the 8.1.4 Panorama upgrade _mig template stacks are automatically created from existing templates.       If this is so, then after teh upgrade I would expect, when amending a config setting the pull down menu on the GUI 'templates-network' should logically still only show templates. ( not template stacks )   Upon upgrade, the GUI top blue bar is not renamed 'template stack'. It appears to offer both the original templates and the new _mig 'template stacks'. Then the config items below, can 'belong' to the original template or if edited since, may 'belong' to the new _mig template stack. This is very confusing, but perhaps points to a subtlety of understanding I am missing.      To my mind and a clear distinction in the gui should be made. Templates for config items and then the  'template stack' container being applied to the associated device.         I assume other admins have been through this migration pain and can enlighten me on using the seemingly confused Panorama GUI after the 8.14 upgrade.   All comments on the now mandatory template stacks and how the Panorama GUI should be interpreted very much appreciated.   Lee     ... View more