About bvandivier

This is expected behavior and by design.   Informational - the threat (file) was blocked by a Wildfire-virus signature and therefore the firewall alerts the admin at an informational level because the threat was mitigated.   High - the threat (file) was passed by the firewall and not blocked by a Wildfire-virus or Antivirus signature.  This could be due to the configuration or due to the fact that a virus signature to detect and block the file does not exist.   You can derive additional context by also reviewing the corresponding Threat logs relevant to the two Wildfire log entries in your screenshot. ... View more

Both samples were update to "benign" as of 9:43 CST this morning.  Please allow some time for this change to be reflected on virustotal.com. ... View more

Understood, in which case Zone Protection and/or DoS Protection would be the appropriate features to leverage. ... View more

Assuming you will be doing this locally on your firewall (not Panorama) the steps are somewhat straightforward.  There are several community articles and videos on the subject.  Of course, you will also need to enable logging on the relevant security policy rules as well before you will have any log data to run reports against.   https://live.paloaltonetworks.com/t5/Tutorials/Getting-Started-Custom-Reports/ta-p/69951 https://live.paloaltonetworks.com/t5/Management-Articles/Create-a-Custom-Report/ta-p/55143 https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-and-Schedule-a-Custom-Report/ta-p/57442   You'll want to build something similar to the example report below but you will need to play with it until you're capturing exactly what you'd like.  Please be sure to include a query to match on the relevant security policy rules.     Here are the set commands from my example report:   set shared reports IPBL-Report type traffic sortby repeatcnt set shared reports IPBL-Report type traffic group-by day-of-receive_time set shared reports IPBL-Report type traffic aggregate-by [ rule from src sport srcloc to dst dport dstloc action ] set shared reports IPBL-Report type traffic values repeatcnt set shared reports IPBL-Report period last-24-hrs set shared reports IPBL-Report topn 100 set shared reports IPBL-Report topm 50 set shared reports IPBL-Report caption IPBL-Report set shared reports IPBL-Report query "(rule eq 'example IPBL rule 1') or (rule eq 'example IPBL rule 2')" set shared reports IPBL-Report description "PAN Dynamic IP Lists"   And the XML:   reports { IPBL-Report { type { traffic { sortby repeatcnt; group-by day-of-receive_time; aggregate-by [ rule from src sport srcloc to dst dport dstloc action]; values repeatcnt; } } period last-24-hrs; topn 100; topm 50; caption IPBL-Report; query "(rule eq 'example IPBL rule 1') or (rule eq 'example IPBL rule 2')"; description "PAN Dynamic IP Lists"; } } ... View more

Hello, we have submitted this file for manual analysis and potential verdict change to benign.  Please allow us 24 to 48 hours to process this sample.   Thank you. ... View more

Q: I can get a list of the IPs on the dynamic list by running these two commands from the cli:   request system external-list show type predefined-ip name panw-highrisk-ip-list request system external-list show type predefined-ip name panw-known-ip-list   A: Yes, you can.  You can also click on each list within the WebUI from Objects > External Dynamic Lists > List Entries and Exceptions to view list entries.   Q: is there a way to get a list of the URLs/IPS being blocked by the other PA policies?   A: If by "other PA policies" you are referring to URLs/IPs blocked by other features such as AV DNS signatures, etc there is no single aggregated list.  Your best resource would be the Threat Vault @ https://threatvault.paloaltonetworks.com/ ... View more