killbop

Greetings fellow users.

I'm playing around with Palo VM and having an issue blocking certain apps like BBC player and USTREAM.

Policy is dead simple - rule to deny FB\BBC\USTREAM followed by generall Allow ALL rule.
There's no SSL decryption at this stage.
Now FB block works fine, but BBC player and USTREAM are not blocked. I can see how BBC player can slip without SSL decrypion, but USTREAM is plaintext.

IS that an issue with Application Signature accuracy or i'm missing something here?
And yes, I'd rather do it via Application FW then URL filtering if possible.

Cheers.

​

Got QVI installed via Qradar Assistant.

https://i.redd.it/8fkzgch4jt611.png

https://i.redd.it/97cqt3v8jt611.png

Anyone using this?

I've installed it (running on AppNode), got BIND sending logs yet all counters are zero.

https://i.redd.it/gdz19gjtoj611.png

https://i.redd.it/zb7svng5pj611.png

then noticed that DNS analyzer log source is in Error state - not receiving any logs

https://i.redd.it/2geaoqmhpj611.png

Are there any extra steps to get this shit working?

Hi all, Going through network inventory process for customer and he has a zoo of Cisco kit across DCs - N9K,N7K even odd Cat6500s. Is there some kind of guide/chart on what ASICs are used on these? I've been digging through CiscoLive sessions but there's hardly anything that covers all. A one page review would be a godsend...

Thank you.

Trying to setup Sysmon collection. Used this https://hackernoon.com/the-windows-event-forwarding-survival-guide-2010db7a68c4 and this https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem/ as reference

My setup is - Qradar, AD controller and Win7 workstation. I can see the Sysmon logs from AD only in Event Viewer. Nothing from Win7. And 0 logs on Qradar. Only standard MSRPC - Login/Logoff stuff.

Any tips on how to troubleshoot this and is there a less convoluted way to get this running? I'd really rather not go with WinCollect. WEF's central collection and filtering capability is compelling.

Ch