Autonomous DEM Discussions

A lot of poorly intended code (read malware) are designed to go directly to IP addresses that may or may not resolve to nicely constructed dns names. In my experience, these more most likely to be malicious CNC hosts etc. The best practice here is to deny http/ssl to ip addresses.

Blue Coat provides a way to create a filter of the kind http(s)://\d+\.\d+\.\d+\.\d+, but this does not appear to be possible in PA.

Apologies for not clarifying this initially. I thought this would be a common question.

Ash

I think you can do this yourself with a custom url filter.

Otherwise the "proper" solution is to create a custom blacklist rule in front of the other rules (maybe put a whitelist rule in front of the blacklist one :smileysilly:) where you block bad dstip's.

PANDB should be able to be more granular than the Brightcloud db, but I dunno if the PANDB includes ip addresses as "hostnames" or not - parhaps someone from PA (who is lurking this forum) could answer that?

I think I heard my name

PAN-DB does include IP address categorization, though the majority of entries are made up of URLs.  While a lot of malware does go directly to IP addresses, we've also noticed that many streaming media applications behave similarly (eg BBC iPlayer).  If you would like to safely enable these applications, use App-ID to do so.

--Doris

I have not considered moving to PAN-DB from the Brightcloud system. Too many unanswered questions such as quality of categorization, performance etc.

We already permit specific applications upfront.

What we would like to do is block all other traffic to IP addresses and deal with specific exceptions as a safer approach.

Ash

URL Category behavior with rule match condition question in Next-Generation Firewall Discussions 08-17-2023 Intrazone rule - Can`t ssh in Panorama Discussions 08-17-2023 Maximum number of addresses exceeded in Panorama Discussions 08-05-2023 NAT & its Types | U-Turn NAT | Static NAT | Dynamic IP NAT | NAPT in Next-Generation Firewall Discussions 08-03-2023 Blocking IP via host firewall in Cortex XDR Discussions 07-19-2023 Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!