About BoDollis

BoDollis · ‎11-25-2020

Is there a way to test the "Security-Focused URL Categories" with some example of URLs that would match the category? I went looking for them in my log after setting them to Alert and found none. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/url-filtering/url-categories/url-risk-categories.html

BoDollis · ‎09-01-2020

I am not sure this is the correct place to post this. I am trying to install the Prisma Cloud QRadar ( RedLock-1.0.1 ) application in my QRadar deployment and it fails pretty quickly with "An error occured. See console logs for details." Curious if anyone else has seen this or has any suggestions. Sep 1 19:37:45 ::ffff:console_IP_address [tomcat.tomcat] [username@110.10.10.32] com.ibm.si.content_management.ContentManager: [ERROR] [NOT:0000003000][console_IP_address/- -] [-/- -]Failed to import content file [/store/tmp/cmt/out/RedLock-1/RedLock-1.0.1.xml]

BoDollis · ‎02-04-2020

Are Parent or Grandparent device groups not supposed to be able to have Rule Usage tracking? My individual devices have rule usage (Hit Count, Last/First Hit), Child device groups have Rule Usage (Used or Unused), but my Parent and Grandparent device groups all have the "em-dash" for rules that do indicate having hits at the child and individual device level.. Policy Rule Hit Count has been enabled in Panorama since before this hierarchy was created I believe. PanOS 8.1.x Em-dash (—) —When no firewalls in the device group—to which you pushed the policy rule—have Policy Rule Hit Count enabled or available for Panorama to determine the rule usage. Monitor Policy Rule Usage https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/manage-firewalls/device-monitoring-on-panorama/monitor-policy-rule-usage.html

BoDollis · ‎11-27-2019

I am trying to determine how to change the Site Access of the new URL categories (cryptocurrency and grayware). By default, they are Allow, and I want them to be Alert. I can do this via CLI w/ the command from config mode below. set shared profiles url-filtering TEST-ONLY-02 alert grayware What I do not understand is that once changed, I can not change it back via CLI w/o the Site Access being in the default of Allow set shared profiles url-filtering TEST-ONLY-02 block grayware Server error : block 'grayware' is already in use I do not think I need to do this now, but I would like to know how to change a Site Action via CLI. Ultimately, my current problem is changing the new crypto and grayware to block in many URL filtering profiles.

BoDollis · ‎11-24-2019

Am I correct that the naming scheme is considered Major Version . Feature Release . Maintenance Release - hotfix? 8.1.6-h3

BoDollis · ‎11-15-2019

I can tag a rule via CLI, but how can I ask Panorama to show me rules tagged with tag-name? set device-group DG-Name security rules "Existing-rule-name" tag tag-name

BoDollis · ‎11-07-2019

Is it possible to create (scheduled) rule usage reports in PanOS 8, ideally from Panorama on a per device group basis? I see the rule usage data present, seems silly there wouldn't be a capability to query against it. Rules (not) used withing last X days?

BoDollis · ‎09-12-2019

Either one works for me, although it seems like if the query can be done via LDAP syntax it would be more efficient and precise. I did notice that the rule will accept LDAP syntax, but have not tested it beyond a commit validation. More of an academic q: really. Thank you.

BoDollis · ‎09-12-2019

In the group mapping UserID template, we use LDAP syntax (CN=...., OU=...), but in rules, I have always seen Source User expressed in lanman syntax, Domain\User or ...\Group. Is it possible to use the LDAP syntax in the rule as well, and is there and advantage either way?

BoDollis · ‎04-04-2019

We have that not selected, unchecked. When I change a group address object that is only used on 1 device group, all device groups get the update, even though they do not use the object. It may be that the object is there for legacy reasons from before when you mentioned was a feature. Since the object is there from then, the object gets the update. I will have toi create a new object and see if brand new objects oberrve the same behaviour.

BoDollis · ‎04-04-2019

Is there a way to prevent (address) objects created in Panorama from deploying to firewalls/device-groups where they are unnecessary?

BoDollis · ‎04-04-2019

Export the objects via CLI to text, you can use that to create a script to create or remove them on whichever host you like.

BoDollis · ‎10-15-2018

Is it possible to have PanOS firewalls send LEEF syslog to to 1 destination, while also sending raw syslog to a different destination?

BoDollis · ‎10-03-2018

That worked nicely, thank you. FWIW, on Panaroma, need to specify "shared". # delete shared address <address object> tag <tag>

BoDollis · ‎10-03-2018

Static tagging via CLI is pretty straight forward, but how to remove a static tag via CLI?

Member Since	‎12-28-2017 06:49 AM
Date Last Visited
Posts	17

About BoDollis

Testing "Security-Focused URL Categories"

Installing Prisma applicatioin for QRadar fails.

Panorama Rule usage in nested device group hierarchy Policy Rule Hit Count

CLI URL filter, change Site Access?

PanOS version number

Re: CLI URL filter, change Site Access?

Re: PanOS CLI show tags?

Re: PanOS version number

Re: Rule usage report in PanOS 8?

Re: Remove object tag via CLI?

Testing "Security-Focused URL Categories"

Installing Prisma applicatioin for QRadar fails.

Panorama Rule usage in nested device group hierarchy Policy Rule Hit Count

CLI URL filter, change Site Access?

PanOS version number

PanOS CLI show tags?

Rule usage report in PanOS 8?

Re: User-ID LDAP syntax in rule

User-ID LDAP syntax in rule

Re: Objects deploy to unnecessary device groups

Objects deploy to unnecessary device groups

Re: Total Objects and Device Groups

Syslog in both LEEF and raw formats

Re: Remove object tag via CLI?

Remove object tag via CLI?

Network Security

Cloud Security

Security Operations

About BoDollis