About whofstetter

Very useful - Many thanks Albert! ... View more

I ran into the issue with the "Temp. Data Struct path"  when upgrading from the "vanilla" (tgz) image directly to 1.1.24. Needed a   sudo apt-get --reinstall install expedition-beta  as apt would say  "already newest version".   Thanks for the hint - Did the job!   ... View more

This is the latest.... and BPA does work for me. Rgds. ... View more

hmm interresting. I got Best Practices version 3.6.1 reported. Is anything green on "expedition internal checks"? Are you using Chrome?   Rgds, Walter ... View more

The BPA works perfectly for me. Did you press the analyze button? ... View more

Sure, better on e-mail so I can leave SN e.g. in the tabel.... if you shoot me a meesage I'll reply with the log.    TX, Walter ... View more

Pwerfect TX! ... View more

Here it is:   Domain,Receive Time,Serial #,Type,Threat/Content Type,Config Version,Generate Time,Source address,Destination address,NAT Source IP,NAT Destination IP,Rule,Source User,Destination User,Application,Virtual System,Source Zone,Destination Zone,Inbound Interface,Outbound Interface,Log Action,Time Logged,Session ID,Repeat Count,Source Port,Destination Port,NAT Source Port,NAT Destination Port,Flags,IP Protocol,Action,Bytes,Bytes Sent,Bytes Received,Packets,Start Time,Elapsed Time (sec),Category,tpadding,Sequence Number,Action Flags,Source Country,Destination Country,cpadding,Packets Sent,Packets Received,Session End Reason,DG Hierarchy Level 1,DG Hierarchy Level 2,DG Hierarchy Level 3,DG Hierarchy Level 4,Virtual System Name,Device Name,Action Source,Source VM UUID,Destination VM UUID,Tunnel ID/IMSI,Monitor Tag/IMEI,Parent Session ID,Parent Session Start Time,Tunnel,SCTP Association ID,SCTP Chunks,SCTP Chunks Sent,SCTP Chunks Received,UUID for rule,HTTP/2 Connection   Have a good weekend, Walter ... View more

Im wondering if we got a timeline for releasing the repository? ... View more

Sorry, didn't repor @rkemburu wrote: PAN-OS 8.0 HTTP Log Integration with Slack   This document assumes that you have already created a Slack team.  This sample integration was done with a free Slack account.    Once you have created your Slack team, login to your slack account and add an “Incoming Webhooks” custom integration on the slack website.  During that configuration, you will select the channel where the message will be broadcast (#general in this example).  You will also receive a Webhook URL, and an opportunity to customize the Name and Icon for the source of the message.    Here’s a screenshot of the Incoming Webhooks configuration on the slack website:         Next, configure an HTTP Server Profile in PAN-OS 8.0.  Use the first part of the Webhooks URL in the “Address” field.  In this example, it is “hooks.slack.com” using HTTPS on 443 with the POST HTTP method.  Username/Password are not required for this particular integration.     Personally, I was interested in specific “system” events, so this document focuses on the system-level logs.  Similar integrations could easily be done with traffic, threat, and/or URL logs.     This is what the System format looks like:       In the URI Format box, provide the URI portion of the Slack-provided Incoming Webhooks URL, beginning with /service   The content-type must be application/json   Leave the Parameters field blank.   The Payload input box accepts the default Slack-preferred JSON format as documented here:  https://api.slack.com/incoming-webhooks   No additional escaping is required to add the PAN-OS provided variables to the payload.  In this example, I’m using a rich-formatted “attachments” message from Slack, although the basic format works perfectly as well.    Here are two samples that you should be able to cut&paste:   Rich Format Message:   {     "attachments": [         {             "fallback": "$time_generated $device_name reports $severity $subtype event:\n $opaque\n--------",             "text": "$time_generated: <https://pa0.example.com|pa0> reports $severity $subtype event:\n$opaque",             "color": "danger"         }     ] }     Simple Format Message:   {     "text": "$time_generated $device_name reports $severity $subtype event:\n $opaque\n--------" }   Since I was mainly interested in system-level events, I tied it all together in the Device / Log Settings tab.  I haven’t narrowed-down exactly what I want to see in the slack channel, but for the purposes of this test, I wanted to see non-informational ha or crypto events, so used the following system log filter:   (( subtype eq ha ) or (subtype eq crypto)) and ( severity neq informational )   I matched that with the “Slack System Event 1” created earlier.  The configuration looks like this:  Here’s what I see on my desktop in the Slack app when I initiate a manual HA state change via the PAN-OS GUI:       Looks good on the phone too: Created by Jared Valentine - Systems Engineer t back - It does work just fine. As far as I remember I suffered from a cert issue. Regards, Walter ... View more

Nice articel! I just tried to follow theser steps, unfortunately my PA-200 say: Failed to send HTTP request: hooks.slack.com: Peer certificate cannot be authenticated with given CA certificates   Not sure what's the rootcause, I used that slack account with NTOP before and just verified with curl from a Linux machine that the webhook does work.   I'll keep trying 🙂 ... View more