About BoDollis

here you go     http://urlfiltering.paloaltonetworks.com/test-low-risk http://urlfiltering.paloaltonetworks.com/test-medium-risk http://urlfiltering.paloaltonetworks.com/test-high-risk       ... View more

I would actually like to validate that integration still exists.  I bookmarked the documentation but the link seems to be broken:   https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-qradar.html ... View more

Either one works for me, although it seems like if the query can be done via LDAP syntax it would be more efficient and precise.  I did notice that the rule will accept LDAP syntax, but have not tested it beyond a commit validation. More of an academic q: really.  Thank you. ... View more

@mjanik01  Yo're right. It should be more like this pseudocode: Foreach $object in $panoramaobjects {      Foreach $firewall in $firewalls {           If ($object is not in use)                Delete-fw-object($object,$firewall)                Delete-panlrama-object($object,$panorama)           }      } } ... View more

We have that not selected, unchecked.  When I change a group address object that is only used on 1 device group, all device groups get the update, even though they do not use the object.  It may be that the object is there for legacy reasons from before when you mentioned was a feature.  Since the object is there from then, the object gets the update.  I will have toi create a new object and see if brand new objects oberrve the same behaviour. ... View more

@BoDollis,   So this kind of depends on how in-depth you want to get with the siganture and whether or not you truly need to utilize one. For example if I simply want the traffic to be identified you could utilize an application-override policy to note that any tcp/1022 traffic to server 'x' is going to be 'ssh'. Depending on the access rights to this server this may fit your needs perfectly fine.    Alternatively you could create a custom app-id like what I've included here that simply gives you a different app to override the application too.  <application version="8.0.0"> <entry name="ssh-1022"> <default> <port> <member>tcp/1022</member> </port> </default> <subcategory>encrypted-tunnel</subcategory> <category>networking</category> <technology>client-server</technology> <description>Alternative SSH Port</description> <risk>4</risk> <used-by-malware>yes</used-by-malware> <able-to-transfer-file>yes</able-to-transfer-file> <has-known-vulnerability>yes</has-known-vulnerability> <tunnel-other-application>yes</tunnel-other-application> </entry> </application> However if you want to go all out then you would utilize a signature to make sure that you are only matching the traffic that you actually intend to. Certaintly recommended and the best possible solution to something like this, but not necissarly needed in all situations.  When you create a new signature you need to specify certain conditions that will only match this traffic, for example a condition may be that I'm looking at Context http-req-headers for the pattern 'docs.legis.wisconsin\.gov' and a Qualifier of http-method GET. This signature would be able to look at the GET request for docs.legis.wisconsin.gov and classify it as my custom app-id 'Legis-Docs'.    I would recommend that you take a look at the following; both are great resources.  App-ID Video: Getting-Started Custom Applications and App Override:   ... View more

Or it could be Device Tab -> Config Audit.   This way you can compare two different configs and it shows who made the changes. ... View more