Saucepan

User Tools

Site Tools

Trace: • aws • tokens • ntp • ecs • microsoft • ztp • dns • fritzbox_3490 • versions • nslookup
paloaltonetworks:troubleshooting:testing_panos

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
paloaltonetworks:troubleshooting:testing_panos [2023/01/21 16:38] – [DNS Security] bstaffordpaloaltonetworks:troubleshooting:testing_panos [2023/01/21 16:54] (current) – [DNS Security] bstafford
Line 40: Line 40:
  
 If protection is active, the following domains resolve to whatever your sinkhole is set to (e.g. ''72.5.65.111'') or nothing if block is set as the action instead of sinkhole. If protection is active, the following domains resolve to whatever your sinkhole is set to (e.g. ''72.5.65.111'') or nothing if block is set as the action instead of sinkhole.
 +
 +
 +To find example malicious domains, look in the release notes of the active AV file on the firewall (Setup > Dynamic Updates). Search for <code>New Spyware DNS C2 Signatures</code>
 +
 +In built AV file based DNS malware detection:
 +<code>( name-of-threatid contains 'Suspicious DNS Query (Compromised_DNS' )
 +( name-of-threatid contains 'Suspicious DNS Query (generic' )</code>
 +
  
 Don't block Ad Tracking Domains. This will block anything that uses CNAME. This affects most major sites. Don't block Ad Tracking Domains. This will block anything that uses CNAME. This affects most major sites.
paloaltonetworks/troubleshooting/testing_panos.1674319093.txt.gz · Last modified: by bstafford