Application WhiteListing

I have an application that needs whitelisting.

Actions Done:

Add to Allow List

Add to Malware Profile, under specific module that triggered alert/incident.

It is still showing up in incidents when executed. Any idea what could be going on?

AMSI Byte Array Scanning

Does anybody have a solution similar to Defender for Endpoint for using AMSI programmatically to scan incoming files? Essentially, we have a requirement to scan incoming files that are scanned prior to being sent along to their next hop. This all occ

How to download PanOS VM image

I am an individual(not business). I want to download Palo Alto VM image for lab test, may I know is this possible? If so, how could I do it? I have read some Internet post, it says I shall pay and get a "lab license"? If so, how much?

In addition,

Using dynamic names in lists in playbooks

I have a sub-playbook that checks if a list exists and if not, fetches data from an external API and saves the result to that list, the next time the playbook runs it will load it from the list rather than fetching from the external API.

I want this

We deployed MS Autopilot, is it possible to do join AD domain network remotely via GlobalProtect?

We enabled "Connect Before Logon" but cannot sign in Windows, any idea, please?

Help playbook XSOAR - XDR assest and vulnerability module

Hi,

I am creating a playbook with the objective of integrating Cortex XSOAR and Cortex XDR. 

The idea is for Cortex XSOAR to query Cortex XDR , retrieve all the assets detected by the broker scanner, and verify which assets do or do not have the XDR

Having issues with performing a factory reset on Palo Alto 3060

Hello Everyone, I went and followed a guide on a pair of Palo Alto 3060s I bought for my lab from eBay. The first unit I was able to login with the default user name and password and verify it was working no problem. The 2nd unit still had a config o

User Mapping - Server Monitoring Issue

I am currently having an issue with the Server Monitoring.

When I add the DC to this section then under Type: Microsoft Active Directory I want to use the Transport Protocol WinRM-HTTPS but it is only showing WMI and is greyed out.

If I swap the type t

Duplicated objects with same name but different mask

Hi All,

I need help with this tricky thing. It looks like a bug though.

I have 200+ duplicated objects (in pairs) with same name, but different mask (obviously wrong on the duplicate item).

E.g.,

subnet A - 10.0.0.0/16

subnet A - 10.0.0.0/32

The co

GlobalProtect VPN Issues

Hi. Can someone please help me? Thank you in advance.

We are currently experiencing issues with a GlobalProtect VPN setup, it is working for users located in Australia but not in the Philippines, we have set it to allow connections from the Philipp

Integrating FortiAuthenticator with PA Firewall for Multi-Factor Authentication on GlobalProtect

Hello,

I need to integrate my FortiAuthenticator, which is located at a remote site, with my PA firewall to add additional authentication factors for users connecting to GlobalProtect.

I haven't been able to find the documentation and procedures to

SSL No-Decrypt issues

Hello,

I'm testing on two different versions of PAN-OS (11.0 and 11.1).  There's a couple of issues I'm noticing with decryption/no-decryption.  I have a profile setup for no-decrypt in which healthcare-and-medicine is a category that isn't supposed

how frequently XDR will push logs to Cortex?

Hi, 

how frequently XDR will push logs to Cortex? We have application it will write logs 400k per sec and log rotation setup like if file size is 50 MB it will compress the file and zips it. due to this we are missing logs in cortex xdr.

can you plea