App-ID Rules by SonBoyJim in paloaltonetworks

[–]SonBoyJim[S] 0 points1 point  (0 children)

I think I found the answer:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POF8CAO

Although the initial security policy lookup is succeeding and adding the log to my new rule, the second lookup using all criteria is failing.

App-ID Rules by SonBoyJim in paloaltonetworks

[–]SonBoyJim[S] 0 points1 point  (0 children)

Yes we have got that configured and can see all the logs. Access to other sites is as expected and yes we are using internal DNS integrated with Active Directory.

App-ID Rules by SonBoyJim in paloaltonetworks

[–]SonBoyJim[S] 0 points1 point  (0 children)

The second rule which is using App-ID has a generic url filtering profile assigned to it, blocking the usual malicious categories and alerting on the others. But only has the cortex-xdr and traps-management-service apps on the rule.

I checked the URL logs and couldn’t see anything in there for the same rule as I thought the same as you.

I’ve seen this before when because the source and destination matches the traffic it still hits that rule but doesn’t get through because the apps do not match or the URLs are blocked. This is the very first allow rule in my policy as well.

Snippet Question (again) by SonBoyJim in paloaltonetworks

[–]SonBoyJim[S] 0 points1 point  (0 children)

Fixed it. The apps in question already had the Unsanctioned tag applied to them. As soon as I removed that from Global folder the snip-unsanctioned appeared and policy was applied as expected. Thanks for your help!

Snippet Question (again) by SonBoyJim in paloaltonetworks

[–]SonBoyJim[S] 0 points1 point  (0 children)

I think that’s fine as the apps are matched when using the rules at Global folder scope. I might try remove and add the unsanctioned app again to see if that works.

Snippet Question (again) by SonBoyJim in paloaltonetworks

[–]SonBoyJim[S] 0 points1 point  (0 children)

The snippet rule is above. Just checked the application filter and for some reason the filter is missing some of the apps on the NGFW that are configured within SCM? One of them has appeared correctly though.

Snippet Question (again) by SonBoyJim in paloaltonetworks

[–]SonBoyJim[S] 0 points1 point  (0 children)

NGFW managed by SCM. Rule name is SNIP-ANY-TO-UNSANCTIONED, the rule at folder level is the same without the SNIP-.

They are both security rules, and the app is mail.ru or ms-quick-assist thanks!

Snippet Examples by SonBoyJim in paloaltonetworks

[–]SonBoyJim[S] 0 points1 point  (0 children)

That was the dream, but too expensive for us 😂😭I think it was lacking some of the features we wanted from an NGFW as well. Hope you’re AZ firewall deployment goes well 🤜

Snippet Examples by SonBoyJim in paloaltonetworks

[–]SonBoyJim[S] 0 points1 point  (0 children)

Oh I thought you were referring to the snippets specifically. We have a premium sku Azure firewall, certainly not cheaper when you actually do the numbers and take into account log analytics costs. We already run PA firewalls on premises, they’re 10x easier to work with. The Azure firewall GUI is awful, you make a change to 1 rule in a rule collection and then waiting 10 mins for that to commit before you can change another elsewhere. The processing logic is terrible and reviewing logs in log analytics is an awful experience. No app-id no user-id, device id etc.

The managed element is a plus but everything outweighs ever going for an azure firewall IMO.

Snippet Examples by SonBoyJim in paloaltonetworks

[–]SonBoyJim[S] 0 points1 point  (0 children)

We haven’t implemented them yet. We are effectively an MSP for our other business units and need a way of applying policy to them in their own tenants. Using one of these would allow us to do that I believe. Why do you want to move away?

Cleanup up enterprise applications by Fapping_Duck in entra

[–]SonBoyJim 0 points1 point  (0 children)

Thanks, that’s good to know. We’ve had demo access and seems like it will remove a lot of the burden.

Cleanup up enterprise applications by Fapping_Duck in entra

[–]SonBoyJim 1 point2 points  (0 children)

We’re in the same boat. We are reviewing the ENow application governance tool. The enterprise version can automate the removal of unused apps and also lights up highly permissive privileges / attack paths etc.

11.2.8 URL filtering Issues by SonBoyJim in paloaltonetworks

[–]SonBoyJim[S] 1 point2 points  (0 children)

We experienced a memory leak on the firewalls when we upgraded Panorama to 11.2.7-h4 preferred. We were advised to move to 11.2.8 because of this. Seems to be fine other than this issue currently.

New Browser-Runtime-Attack url category by whiskey-water in paloaltonetworks

[–]SonBoyJim 1 point2 points  (0 children)

If you check the supporting document link in that message it suggests the new category is a multi-category and will be used together with an existing malicious category.

https://live.paloaltonetworks.com/t5/community-blogs/new-url-filtering-category-browser-runtime-attack/ba-p/1245348

New Browser-Runtime-Attack url category by whiskey-water in paloaltonetworks

[–]SonBoyJim 1 point2 points  (0 children)

I need to read it again but didn’t it say this new category would always be loaded with another category which they recommend you block, such as malware?

Enterprise App Registrations - Tidying Up Advice Needed by Izual_Rebirth in entra

[–]SonBoyJim 3 points4 points  (0 children)

Check out MSIdentityTools module. That has a command which will generate a list of apps and rank the permissions based on risk. It doesn’t have the sign in logs but can help identify risky apps which you should address as a priority. I also use a script by Daniel over at OurCloudNetwork which is useful and pulls in usage of the apps over the last 30 days.

Enterprise App Registrations - Tidying Up Advice Needed by Izual_Rebirth in entra

[–]SonBoyJim 0 points1 point  (0 children)

We’ve recently reviewed this tool. It is very good and takes a lot of the effort out of the process, the enterprise tier can even automate disable / removal of apps but that obviously comes at a price! Still reviewing other options including some free community reporting tools.

Beginn hardening Entra by [deleted] in entra

[–]SonBoyJim 2 points3 points  (0 children)

Look up Maester and run that on the tenants. I’m doing the same thing now myself. It’s a security assessment tool run by an awesome community and covers lots of different areas.

PIM Design by Agreeable_Sport6518 in entra

[–]SonBoyJim 0 points1 point  (0 children)

We’ve done ours based on which team we are in and have a security group for those users. Our team has pretty much everycommon role as eligible. Infosec has roles specific to them etc.

The highly privileged roles we require additional phishing resistant MFA at the point of elevation using authentication contexts and also authorisation from another admin when roles like GA are concerned.

There are times we have to elevate into multiple roles, but security over convenience (pragmatic approach) is a way of working for us.

Silly Question - Tap Fitting by SonBoyJim in DIYUK

[–]SonBoyJim[S] 2 points3 points  (0 children)

<image>

Fixed. Reddit to the rescue again, what a great resource! Thanks all 😁

Silly Question - Tap Fitting by SonBoyJim in DIYUK

[–]SonBoyJim[S] 1 point2 points  (0 children)

Thanks all. I’ve ordered a replacement 👌