About mivaldi

@tomber You should open a Support ticket for this. This forum is mean to provide assistance to VirusTotal users that are not Palo Alto Networks customers, regarding FP detections by Palo Alto Networks observed in VirusTotal detection reports, and not in firewalls. ... View more

Yes, the explanation is that the sample was observed by WildFire but never observed by VirusTotal. For the FP investigation please open a Support case. ... View more

This solution was superseded by the ability to set DHCP Options. See article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000saawCAA ... View more

This is not related to a VirusTotal issue. This forum section is for non-customers reporting incorrect detections. Please open a Support case or post in the Threat Discussions section. Ref. https://live.paloaltonetworks.com/t5/threat-vulnerability-discussions/bd-p/Threat_Discussions ... View more

Documented the solution in a Knowledge Base Article: How to implement DHCP Option 119 (Domain Search List) in a Palo Alto Networks firewall ... View more

@GlobalAxis what PAN-OS version are you running? ... View more

Why do you want to report it via email? ... View more

Also check if the misdetection began around March 15, 2022, that's when the change was pushed in Content. https://live.paloaltonetworks.com/t5/customer-resources/app-id-decoders-enhancement-plan/ta-p/469547   You can test adding ntp-non-rfc as an allowed app in your policy to see if it resolves the issue. ... View more

I replayed your PCAP to my lab. I see NTPv4 traffic detected as ntp-base, and NTPv1 traffic detected as ntp-non-rfc. I don't see any bittorrent traffic, but I am running 10.2.2, maybe your PAN-OS identifies it differently. Check the source ports of the sessions identified as bittorrent, and compare them to your packet capture to see if there is a correlation between NTPv1 and bittorrent, versus NTPv4 and correct identifification of ntp-base traffic. It is possible that your firewall is detecting ntp-non-rfc as bittorrent. ... View more

Sorry but I don't believe this has anything to do with VirusTotal either. This forum is for non-customers. The Threat and Vulnerability forum may have been a better fit, however, posts in the LIVECommunity expect answers from other Palo Alto Networks customers. If you need a response from Palo Alto Networks Support, the correct avenue for help is filing a Support ticket. ... View more

I'm not familiar with this topic. ... View more

I've seen this in the past caused by issue PAN-99976, but it could be something entirely different. Please open a case with Support. You will likely need to submit the crash info file. ... View more

Please open a Support case. ... View more

Yes, you can enable extended logging in WildFire > debug wildfire upload-log log extended-log yes  The computed SHA256 hash of files inspected by the WildFire Analysis Profile for wildfire forwarding will be written in the wildfire-upload.log log-file in the MP. To visualize it use command: > less mp-log wildfire-upload.log ... View more