About hisingh

Hello @vera.kalyuzhnaya    We are in the process of reviewing the file and we will update you once I hear more.   Thanks Himani ... View more

@JTKoris and @benparker    Here is KB article https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UgRCAU Thanks Himani ... View more

Hello @ckopta    The App threat version 8577 has released the coverage for CVE-2022-26134 92632 Atlassian Confluence Remote Code Execution Vulnerability CVE-2022-26134   I hope that helps. Himani ... View more

Hello @TomYoung and @Chris_Johnston    Thank you for the post.   What are we solving; Identify the ICMP request and reply using a custom threat signature. For ICMP response ( echo-response):  In the custom vulnerability signature, the identity echo-response is easy as the context is available.  The signature  44000, will work perfectly as we have selected icmp-rsp-code [ as 0] and you can also add icmp-rsp-type [ also as 0].  The threat logs is shown as below.       For ICMP request, that is echo request:  This is hard to identify as in the custom vulnerability signature, there is no context to select "icmp-req-code" or "icmp-req-type". The below line will match the payload in the icmp protocol.   >>set threats vulnerability 44008 signature standard icmp-req-data and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match context icmp-req-data The best way to identify the response code is, please use the custom application identification with ICMP base and select the Type and code as follows.   CLI: show application icmp-echo-request set application icmp-echo-request default ident-by-icmp-type type 8 set application icmp-echo-request default ident-by-icmp-type code 0 set application icmp-echo-request subcategory internet-utility set application icmp-echo-request category general-internet set application icmp-echo-request technology network-protocol set application icmp-echo-request risk 1 set application icmp-echo-request parent-app icmp [edit]   show threats set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 1" or-condition "Or Condition 1" operator equal-to value 0 set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 1" or-condition "Or Condition 1" operator equal-to context icmp-rsp-code set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 1" or-condition "Or Condition 1" operator equal-to negate no set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 2" or-condition "Or Condition 1" operator equal-to value 0 set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 2" or-condition "Or Condition 1" operator equal-to context icmp-rsp-type set threats vulnerability 44000 signature standard icmp-rsp-code and-condition "And Condition 2" or-condition "Or Condition 1" operator equal-to negate no set threats vulnerability 44000 signature standard icmp-rsp-code order-free yes set threats vulnerability 44000 signature standard icmp-rsp-code scope protocol-data-unit set threats vulnerability 44000 default-action alert set threats vulnerability 44000 threatname "ICMP echo response" set threats vulnerability 44000 severity informational set threats vulnerability 44000 direction both set threats vulnerability 44000 affected-host client yes set threats vulnerability 44000 affected-host server yes ... View more

Hello @FarhanKoujalgi    If you want the CLI only, here are the steps assuming that you have a security rule, say rule-1, that is inspecting traffic to your web access to management, and that rule has vulnerability profile as default-base. > configure #set profiles vulnerability default-base threat-exception 91439 action reset-both   Best Himani ... View more

Hello @FarhanKoujalgi    You can enable the threat ID by CLI given in https://security.paloaltonetworks.com/CVE-2021-3050 By default, Severity Threat-ID 91439 is high and action is blocked.  You really don't have to take any action if you have the following: (a) A vulnerability profile is attached to the traffic to your management IP (b) Your management IP traffic is passing through your firewall data-port (c) your vulnerability profile-> vulnerability rule -> high/critical severity is set to block or default.    Please note the firewall does not run IPS on the traffic destined to the management *port*, the recommendation is either to force management traffic through the firewall,  or migrate the WebUI management of the device to a data port for in-band management using an interface management profile. Here is an article at  https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/getting-started/best-practices-for-securi...   Other than the in-band solution, a few ways to force traffic through the firewall for out of band management are to create a  spare data port on a separate Management Zone, associate a management interface profile to it, and define all service routes to source from this interface. Define an Interzone security policy for the Management Zone with an associated Vulnerability Protection profile to have the traffic scanned. This solution requires a single spare data port.  vWire can be another solution.     The fixed version of PAN-OS  10.1.2 and 9.1.11 is released.     Thanks Himani ... View more

Hello @artiomcarabas    My apology for the short sentence, This sample is marked as benign and this signature is been disabled.  Thank you Himani ... View more

Hello @artiomcarabas    This sample is disabled.   Himani ... View more

Hi @RayL    This hash is marked benign, this file should not be blocked anymore.   Best Himani ... View more

Hello @RamonUnch    This sample has been submitted to review. We will update soon   Himani ... View more

Hello   Are you using putty? The older version of putty will not support this configuration.  Please use the  latest version of putty, or teraterm or secure CRT.   Best Himani ... View more

Hello,   This signature is been disabled, and this domain( including some of the sub-domain) are categorized as  Computer and Internet Info, Low Risk.   let me know if you have any more question    Himani ... View more