About emgarcia

  Blog written by Wendi Whitmore and published on June 10, 2024.     Today, Palo Alto Networks Unit 42® was named a Leader in The Forrester Wave™: Cybersecurity Incident Response Services, Q2 2024. We see this achievement as a testament to our unwavering commitment to our clients’ security needs and the proven effectiveness of our incident response approach.   The threat landscape is growing more complex as attacks increase in speed, scale and sophistication, especially as attackers leverage AI. In addition, there’s added pressure on organizations to identify, contain and remediate attacks in a timely manner in light of new regulations around cyber incident reporting. An analysis of the top 35 global breaches in a 2023 Forrester report found that attackers exposed over 1.5 billion customer records, and regulatory bodies levied over $2.6 billion of fines for incidents and privacy violations.   In this high-stakes landscape, organizations need a trusted IR partner who can help them proactively prepare for, respond to, and recover from incidents as quickly as possible. Preparedness to face a security issue has become more important than ever for modern organizations.   The Forrester Wave for Cybersecurity Incident Response Services   Unit 42 received the highest score possible in nine criteria, including Innovation, Technology, Threat Intelligence, Cloud Environments, as well as IR Leadership and Team Structure. In The Forrester Wave™ evaluation, Forrester states:   Palo Alto Networks expands its reach – and value – to security leaders and execs. The Forrester report also notes that, “Reference customers are impressed with Unit 42’s cloud IR expertise and the efficacy of its technology and Arcade’s ease of use…” We believe that these capabilities, combined with our commitment to customer success, have earned us recognition as a Leader in the Forrester Wave.   Stay Ahead of Threats with Unit 42   Unit 42 is your strategic, end-to-end security partner, delivering faster resolution times, unmatched scale of threat intelligence, and the advanced tools needed to win against today’s sophisticated attackers. This is all backed by the power of the largest cybersecurity company on the planet.   The Unit 42 team of global experts are at the forefront of incident response, offering a comprehensive suite of services designed to address the multifaceted challenges of cybersecurity. We combine deep threat intelligence with cutting-edge technology to deliver rapid, effective incident response.   Unit 42 Arcade — Your Cyber Resilience Command Center   Our Unit 42 Retainer clients can utilize our new retainer management solution, Unit 42 Arcade. Forrester mentioned Arcade in their report: “Unit 42 recently launched Arcade, an IR client onboarding and retainer management platform designed to establish a client’s security profile, gain situational awareness of the client’s environment and serve as a relationship hub.”     Arcade enables clients to take control of incident response and cyber risk management with 24/7 visibility into retainer credits, available services and usage history. Make the most of your retainer by using credits for incident response, proactive services or a mix of both, all with expert guidance. With the Unit 42 Retainer and Arcade, we'll help you get up and running quickly, assess your current situation, and create a plan to strengthen your security posture.   Technology-Driven Transformation with Unit 42   Unit 42's approach to incident response is more than responding quickly and effectively to incidents; it's about transforming your security posture and improving overall cyber resilience. By leveraging Precision AI™, our proprietary AI system that helps security teams automate detection, prevention and remediation can help you move from reactive to proactive.   Through each incident response engagement, we feed back insights to Palo Alto Networks that enhance our threat intelligence, creating a continuous improvement cycle to keep you prepared for future threats. Further, Unit 42 leverages insights gleaned from incident response engagements to help our clients determine how to create a security strategy that reduces the likelihood of future attacks and increases the likelihood of keeping their business online.   To learn more, download your complimentary copy of The Forrester Wave™: Cybersecurity Incident Response Services, Q2 2024.   To discover how Unit 42 can empower your organization with comprehensive cybersecurity solutions, visit our website.   ... View more

      Blog written by Meghna Muralinath, Matt Harms, and Kanthi Sarella     When deploying application workloads in the AWS environment, adhering to the principles of zero trust is essential. Beyond monitoring ingress/egress traffic, it's crucial to inspect inter VPC and inter-region traffic to stop the lateral spread of threats and align with security policies.    Palo Alto Networks is excited to announce the integration with the new AWS Cloud WAN service insertion feature. This integration allows you to seamlessly insert Palo Alto Networks software firewalls(Palo Alto Networks Managed Cloud NGFW or self-managed VM-Series firewalls) to inspect inter-VPC and inter-region  AWS cloud WAN traffic.    Cloud WAN service insertion now streamlines the redirection of the following traffic flows to Palo Alto software firewalls for inspection, whether originating from the same or different segments:   Inter-VPC traffic. In the same or across regions (inter and intra segment) Traffic to and from AWS infrastructure destined for the public internet. Traffic to and from AWS infrastructure, on-premises data centers, remote office branch offices (ROBO), and other environments.   Ensuring security compliance on different traffic flows is now achieved by defining simple policies. These policies facilitate the redirection of traffic to Palo Alto software firewalls configured as Network Functions Group (NFG) for inspection.   Applications in a single or multi-region need to communicate with each other to send, retrieve, store data or just stay in sync. Let's imagine our task is to secure the AWS environment shown below. Inspecting traffic to and from the applications at different boundaries is one milestone of zero trust. In addition to ingress and egress traffic all inter VPC traffic be it inter or intra region should be inspected by a firewall. For best in class security use Palo Alto’s software firewalls.     It is best practice to have Palo Alto Networks Software firewalls (Cloud NGFW or VM-Series) per region to inspect intra-region communication with minimum latency. Prior to the Cloud WAN service insertion feature, inter-region traffic required double inspection to maintain flow symmetry, once in the source and again in the destination region.  Now service insertion allows deterministic single-hop inspection for inter-region traffic.       Applications are connected to cloud WAN core with cloud WAN attachments and connecting to the core network.    Separate applications by placing them in the same or different Network Segment. Applying different policies for inter and intra segment traffic irrespective of the region of the application.    VM-Series / CNGFW firewalls are connected to the Network Core and tagged to be in a Network Function Group (NFG).This can be done by using tags defined in the attachment policy.     If you haven't upgraded to a bigger screen after that picture, kudos on your screen-squinting stamina! Now, let's zoom in on a tiny slice of this deployment and see how Cloud WAN service insertion can work its magic and redirect traffic flows to the software firewall for inspection.    The table below summarizes the different applications whose traffic flows we will be securing and how they map to the Cloud WAN core.       A Netsec admin’s wishes come true - With service insertion, there's no need to worry about setting up or sharing routes to redirect traffic to the security VPC. Simply define the service insertion policies like the example shown below and watch the magic.     Let's overlay different traffic flows to the deployment and policies discussed and see how they are redirected for inspection:   Outbound traffic from the application- Follow the packet path marked (A) to (K) for traffic from a  client in Spoke1 VPC to a server on the internet   Packet leaves workload to VPC Routing.  Traffic is sent to the Core Network attachment of Spoke 1 VPC. Packet enters Core Network in segment of Spoke 1 (Prod Segment).  Traffic matches Service Insertion send-to (Internet Egress) policy.  Packet is sent to forwarded to Inspection Network Function Group Packet enters region local NFG VPC.  Traffic is forward to Availability Zone (AZ) local Gateway Load Balancer Endpoint (GWLBE). Packet is transmitted via PrivateLink to Gateway Load Balancer (GWLB) GWLB selection healthy VM-Series instance and encapsulates original packet in GENEVE header that includes that identifier of the GWLBE that received it. The selected VM-Series instance receives the encapsulated packet and applies security policy to the inner packet.  if allowed the  packet is returned to the GWLB in a GENEVE packet. The GWLB receives the packet and uses the GENEVE header to send the packet to the GWLBE that originally received the packet. The packet leaves the GWLBE and a VPC routing is referenced to send the packet to the AZ local NAT Gateway The packet is received by the NAT Gateway.  Source NAT is applied with the private IP of the NAT Gateway. VPC routing sends the packet to the Internet Gateway (IGW) Source NAT is applied to the packet with the public Elastic IP of the NAT Gateway The listener on the server receives the packet   Highlight: The application segments are strictly isolated with the security NFG being the only bridge. This required no route sharing.    2. Inter-region, inter-segment traffic: Follow the packet path marked (A) to (K) for traffic from a client in Spoke 1 VPC (Prod) in us-east-1 to a server in Spoke 4 VPC (Dev) in us-west-2.  Traffic symmetry is established by appliance mode attachment for the Security VPCs and deterministic selection of regional security inspection VPCs by default region priority or explicitly preference in regional pairs in the Service Insertion policy.   Packet leaves workload to VPC Routing.  Traffic is sent to the Core Network attachment of Spoke 1 VPC. Packet enters Core Network in segment of Spoke 1 (Prod Segment).  Traffic matches Service Insertion send-via policy for Prod to Dev traffic.  Route lookup is performed in the Prod segment in the source region (us-east-1).  Packet is forwarded to Security 1 VPC in us-east-1 based on region priority. Packet enters region local NFG Security VPC in the AZ that was selected by the appliance mode configuration.  The AZ Attachment VPC Route table routes the traffic to the AZ local GWLBE.  Packet is transmitted via PrivateLink to Gateway Load Balancer (GWLB) GWLB selection healthy VM-Series instance and encapsulates original packet in GENEVE header that includes that identifier of the GWLBE that received it. The selected VM-Series instance receives the encapsulated packet and applies security policy to the inner packet.  if allowed the  packet is returned to the GWLB in a GENEVE packet. The GWLB receives the packet and uses the GENEVE header to send the packet to the GWLBE that originally received the packet. The packet leaves the GWLBE and a VPC routing is referenced to send the to the Security VPC attachment to the Core Network The packet enters the Core Network in the Inspection NFG.  A route lookup is performed and the packet is sent to Spoke 4 VPC attachment in the us-west-2 region. Upon entering Spoke 4 the VPC route table of the attachment subnet is used to forward the traffic to the server The server receives the packet from the client   Highlight: The inter-region, inter-segment traffic is inspected once by VM-Series in the NFG segment based on the single hop ‘send-via’ policy.   Management of the software firewalls: Customers can have a single management interface for all PAN firewalls deployed in different environments. There are two management options in common for both Cloud NGFW for AWS and VM-Series: Strata Cloud Manager (SCM) or Panorama.    Strata Cloud Manager is a SaaS management engine. The management and policy definition can be done on a customer’s own tenant. Cloud NGFW for AWS and VM-Series instances communicate with SCM on the public Internet.   Panorama is a customer operated management system that can be deployed on virtual or physical appliances. The virtual form factor can be deployed in public or private clouds.   Prior to Service Insertion, Security inspection VPC attachments were members of a Cloud WAN segment and could be configured to allow communication with other segments.  This will affect management and monitoring of VM-Series instances in the VPCs of a NFG.  This challenge is most pronounced if the management interfaces of the VM-Series instances do not have public IP addresses and/or Panorama is privately addressed.  This can be overcome by establishing an alternative path to the management ENIs of the VM-Series instances through the use of private network constructs available in AWS. These include:   Site to Site VPNs via a VPN Gateway associated with the Security VPC VPC Peering with the Security VPC VPC attachment to a Transit Gateway with Site to Site VPNs or Direct Connect circuits The management interface of the VM-Series EC2 instances in a management VPC that is independent of the Security VPC through the use of Multi-VPC ENIs   If Palo Alto Cloud NGFW (CNFGW) is chosen for traffic inspection, the NFG segment will be mapped to it during setup. The traffic flows will be very similar to the flows highlighted earlier in the blog. Overall topology      With security at the forefront of everyone's concerns, we aim to show through this blog how simple it is to redirect traffic for inspection using Palo Alto Networks software firewalls in AWS with Cloud WAN Service Insertion.   Experience the power of the partnership between AWS and Palo Alto Networks first hand! Join us at AWS re:Inforce 2024 to see how we can help you simplify your AWS security needs.    ... View more

  Fuel User Group will be hosting a virtual Spark User Summit on June 20: Using Prisma Cloud with Terraform.   This special event, from 9:30 until 11:30 a.m. PT on Thursday, June 20, is dedicated to Prisma Cloud with Terraform. This demo aims to showcase the seamless interoperability between HashiCorp Terraform and Prisma Cloud, emphasizing how Prisma Cloud secures infrastructure as code (IaC) deployments managed by Terraform. Attendees will learn how to integrate these tools to enhance cloud security posture and automate compliance checks throughout the CI/CD pipeline.   Meet the Speakers       Register Now for Fuel's June Spark Event: Using Prisma Cloud with Terraform     Additional Information   Fuel Spark events are attended by cybersecurity professionals from around the world and are a great way to connect with peers, stay abreast of trends, and hear the latest updates and threat research from Palo Alto Networks.   For more information or to become a member today, please visit the Fuel User Group website.   ... View more

  Comment down below for a chance to win a Palo Alto Networks branded backpack!    if you attended Ignite on Tour: Denver on June 11, 2024, comment and tell us what you liked about it!   Good luck to those who enter and thank you for participating!        ... View more

  Businesses today are increasingly adopting AI to augment human productivity and drive operational efficiency. As they do so, it is crucial for them to assess not only the benefits but also to take stock of the challenges posed by incorporating AI - to ensure that it is done in a safe and controlled manner.   Join Anupam Upadhyaya, VP Product Management at Palo Alto Networks, and Dr. Christina Liaghati, Trustworthy & Secure AI Department Manager at MITRE ATLAS, as they discuss how to increase the trustworthiness and security of AI-enabled systems, including discussing real-world adversarial attacks on AI-enabled systems, what cybersecurity implications they pose to enterprises and what we can do to understand and mitigate these emerging risks and threats.   See how Prisma SASE is redefining expectations and disrupting today’s digital modern workforce.   InterSECt 2024 - Watch Now!   ... View more

  Cybersecurity for the AI Era 2023 was a breakthrough year for AI, and enterprises around the world now find themselves on the crest of a new wave of disruption. Organizations are ramping up investments in AI, particularly in generative AI, to increase automation, improve content creation, and enhance customer and employee experiences.    Hyatt Regency ColumbusBut AI is a double-edged sword, benefiting businesses and cybercriminals alike. As AI-powered attacks become a part of everyday life, businesses, governments, and individuals must turn to emerging technologies, such as AI and ML, to generate their own automated responses. Discover a new approach to cybersecurity for the AI era at Ignite on Tour Columbus. Bringing Ignite to Your Doorstep Ignite on Tour brings cybersecurity practitioners and decision makers together for one exciting day packed with inspiring thought-leadership keynotes, hands-on workshops and technical breakouts, and networking opportunities.    Discover How You Can Harness AI to:   Solve for tomorrow’s SecOps challenges today Enable cloud transformation and deployment Accelerate incident response and speed investigations Apply best-in-class network security Secure hybrid workforces consistently and at scale Defend mobile networks and IoT devices   Join us at Ignite where you'll find the Livecommunity team with some awesome swag, and a chance to snag some cool prizes!     Tuesday, June 18, 2024     Register now to secure your spot!                       ... View more

  We're proud to highlight one of our most engaged contributors for our June 2024 LIVEcommunity Member Spotlight!   For the June 2024 Member Spotlight, we’d like to applaud one of our very own Cyber Elite Members, @SutareMayur, for their participation and engagement in the LIVEcommunity.   Since joining the community in 2020, they've written 571 posts, received 200 likes, and authored 108 solutions (and counting). Awesome participation!       Thank you for your contribution and participation in the community @SutareMayur.   Thank you for being an inspiration to our community! Your presence is invaluable to us. Have a user in mind who deserves recognition for their community contributions? Share their name in the comments below!   Thanks for reading, and stay tuned for next month's Member Spotlight! ... View more

  Author: Katie Bianchi, SVP Chief Customer Officer and PRIDE Network Group executive sponsor   Pride Month is a reminder of the strides we have made toward equality and acceptance. It also underscores the ongoing need to advocate for the rights and dignity of LGBTQIA+ individuals. This month, we celebrate the rich history and culture of the LGBTQIA+ community and reaffirm our commitment to creating a workplace where everyone feels valued, respected, and free to be their true selves.   At Palo Alto Networks, we believe that diversity is our strength. As a member of the LGBTQIA+ community, it is an honor to support and stand alongside our LGBTQIA+ employees during this celebration of belonging, diversity, and inclusion. Our PRIDE Employee Network Group plays a crucial role in ensuring that every voice is heard and that every team member can bring their authentic self to work. I am grateful for their efforts, in partnership with Allies, to create awareness and community by offering a supportive network that empowers our fellow LGBTQIA+ teammates.   Pride Month is also our opportunity to amplify LGBTQIA+ history and to actively participate in building an inclusive culture. Here are a few ways we can all participate:   Educate Ourselves and Others: Take the time to learn about LGBTQIA+ history, issues, and challenges, and foster an environment of understanding and empathy. Show Visible Support: Whether it’s wearing a rainbow pin, attending Pride events, or participating in your company’s LGBTQIA+ employee resource group activities, visible support sends a powerful message of solidarity. Advocate for Inclusion: Advocate for inclusive practices inside and outside the workplace. Speak up and support policies that promote equality. Engage in Meaningful Conversations: Engage in open and honest conversations with colleagues and listen to their experiences and perspectives.   Our journey towards inclusivity doesn’t stop at the end of June. It is a continuous commitment that we must uphold every day. Let’s use Pride Month as a catalyst to renew our dedication to this cause, ensuring that our workplace is a place where everyone, regardless of their sexual orientation or gender identity, can thrive.   Happy Pride Month! Katie ... View more

  Welcome to our May 2024 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   In May, we featured a ton of articles and blogs on: our recent member spotlight, the release of a new Threat Vector podcast episode - catch up now!, how to register for Denver and Columbus Ignite events, the latest Product-centric blogs, new PANCast episodes and a lot more! Read on to see the community's May 2024 highlights.    Community Highlights   Recent Member Spotlight Read highlights of our most engaged contributors with our monthly LIVEcommunity Member Spotlight!   LIVEcommunity Member Spotlight - May 2024: @BPry   Other Interesting Highlights   Don't Miss Out: Ignite on Tour Denver - Register Now! (Tuesday, June 11, 2024) Ignite on Tour brings cybersecurity practitioners and decision makers together for one exciting day packed with inspiring thought-leadership keynotes, hands-on workshops and technical breakouts, and networking opportunities. Register now for the upcoming Denver meetup!   Celebrating Asian Pacific American Heritage Month: Honoring Diversity and Resilience May marks a significant time for celebrating the rich tapestry of cultures, histories, and contributions of Asian Pacific Americans. Asian Pacific American Heritage Month, observed in the United States since 1978, serves as a platform to honor the diverse heritage and commemorate the remarkable journey of Asian and Pacific Islander communities. To learn more, read our blog…   Don't Miss Out: Ignite on Tour Columbus - Register Now! (Tuesday, June 18, 2024) Ignite on Tour brings cybersecurity practitioners and decision makers together for one exciting day packed with inspiring thought-leadership keynotes, hands-on workshops and technical breakouts, and networking opportunities. Register now for the upcoming Columbus meetup!   Fuel User Group: Spark User Summit On Demand Now - May 2024 The latest Spark User Summit took place on May 23, 2024, and focused on AI in the Age of Cybersecurity. We had a fantastic turnout and want to ensure you have access to the recording and presentation in case you missed them. Catch up now!   Product Insights   Focused Services Proactive Insights Newsletter - April 2024 Edition  Read the latest insights from the Focused Services group!   Meet the New Ruggedized PA-400R Series Today, we’re pleased to announce the PA-400R Series, three new ruggedized ML-Powered Next-Generation Firewalls (NGFWs). With the PA-450R announced in Cosmos last year, Palo Alto Networks now expands its offering to  four industry-leading performance and security appliances for remote and harsh customer environments. Read more in our blog…   Palo Alto Networks Extend support for Quantum Safe VPN with RFC 9242, RFC 9370 standards, and Hybrid KEMs  This blog reviews the second PQ VPN component based on two additional standards - RFC 9242 Intermediate Key Exchange and RFC 9370 IETF Multi-key Implementation in IKEv2. With these technologies, customers can create crypto profiles to allow the firewall and its peer to negotiate up to 8 (1 IKEv2 default/classic KEM and an additional 7 PQ KEMs) rounds of key exchange to produce a hybrid key. Learn more in our blog…   Palo Alto Networks Delivers First-Ever Reference Architecture for AI Runtime Security With NVIDIA NIM Palo Alto Networks is collaborating with NVIDIA to deliver the first ever joint reference architecture for AI security with NVIDIA NIM. Enterprises can safely build and run intelligent automation (IA) technologies with a reference architecture that secures generative AI deployments built on NVIDIA NIM in enterprise environments with Palo Alto Networks AI Runtime Security technologies. Find out more in our blog…   Exploring the Functionality of Our New Advanced DNS Security Subscription We have had the DNS Security subscription for just over 5 years now, and in that time it has been extremely successful at solving major issues that companies were struggling with such as data leakage via DNS tunneling, domain risks like fast flux, dynamic generation of DNS, and many more. Find out more in our blog…   GlobalProtect Support for DHCP-Based IP Address Assignments With PANOS 11.2, you can now configure a DHCP server profile on the GlobalProtect gateway to use DHCP server for managing and assigning IP addresses for the endpoints connected remotely through the GlobalProtect app. (Please note that this is only supported on the VM series firewalls with PANOS 11.2). Find out more in our blog…   Cortex Copilot: In SecOps, You Should Secure Smarter, Not Harder There are a lot of moving parts in security operations. As cyberthreats continue advancing in speed and complexity, analysts must investigate and remediate incidents as quickly as possible. However, the time it takes to fully respond to an incident highly depends on a security analyst's skill level and experience with the tools they have at hand. Find out more in our blog…    Now Available: Compliance Centric SaaS Security Posture Management Solution We are excited to announce the latest innovation in SaaS Security Posture Management- An actionable compliance-centric view for managing all their enterprise applications configurations in one place. Rolled out on May 13, 2024, this feature marks a significant leap forward in empowering customers with advanced visibility and control over the configurations of their enterprise cloud applications. Find out more by watching the video…    Playbook of the Week: Automating Response to Living-Off-the-Land (LOTL) Attacks This playbook is part of the Cortex XDR content pack. It offers a comprehensive solution to improve and simplify the difficult task of collecting vital information, examining, and analyzing alerts associated with remote command line execution. These alerts can be especially challenging to identify because they may look like legitimate commands. Find out more in our blog…    Ease Your Data Security Transition with Palo Alto Networks Enterprise Data Loss Prevention Migrator Migrating policies and configurations shouldn't be a headache. That's why we're excited to introduce the Palo Alto Networks Enterprise Data Loss Prevention (DLP) Migrator for Data Security. The migrator will help customers migrate their existing DLP policies from Symantec to Palo Alto Networks to protect sensitive data and reduce risk. Find out more by watching the video…   Securing Kubernetes Clusters: The Cortex XDR and XSIAM Approach Kubernetes has revolutionized the way we deploy and manage applications, but its complexity and dynamic nature also introduce a new set of security challenges. Attackers are constantly looking for ways to exploit vulnerabilities in Kubernetes clusters, and it's crucial to have security measures in place to protect against these threats. Find out more in our blog…   Zero Trust Based Cloud Applications and Its Data Access Control Solution is Now GA Administrators can now create user identity-based and cloud dynamic user group based policies (Role, Department, Region, Manager, AD Group) from SaaS Inline to be enforced in various control points. The User Section on SaaS Inline policies will not only include discovered users but also all users in the organization, enabled by the CIE integration. Admins can now distinguish between named and guest users. Find out more by watching the video…   Introducing ATP Local Deep Learning: Revolutionizing Threat Response Speed for High-Throughput Environments In today's digital landscape, where threats continue to evolve and increase, speed is of the essence when it comes to threat detection. We're thrilled to announce an exciting enhancement to Advanced Threat Prevention: Local Deep Learning. Find out more in our blog…    Migrating Historical Data into XSOAR Migrating historical data into Cortex XSOAR involves a multi-phase process designed to ensure a smooth transition while maintaining functionality across both the old and new systems. The migration process can be customized based on specific requirements and constraints. Find out more on the structured outline of the approach in our blog…    Always Innovating in NetSec Series: Innovations Beyond Precision AI On May 7th, Palo Alto Networks announced New Security Solutions Infused with Precision™ AI at the Unveiling the Future of AI & Cybersecurity event in San Francisco. This month, we also announced new innovations in Medical IoT Security, Cloud Identity Engine and Advanced Threat Prevention. Find out more in our blog…    A New PANCast Episode Is Out!   PANCast™ is a Palo Alto Networks podcast that provides actionable insights from cybersecurity experts to customers, helping them ensure each day is more secure than the one before it. Visit our PANCast™ homepage to learn more and watch our previous podcasts in this series.   PANCast™ Episode 42: Monitoring your PAN-OS Devices   Catch Up on the Latest Threat Vector Podcast Now!   Navigating the AI Frontier: A Security Perspective with Mike Spisak   May ‘24 Discussion Highlight: Posts With Accepted Solutions   Nominated Discussions help LIVEcommunity Solutions Engineers highlight a discussion that has an Accepted Solution, and turn it into an article with additional helpful information, documentation, and clarity! Here are the Nominated Discussions we published this past month:   Nominated Discussion: Action=Allow While NATDestinationIP=0.0.0.0 (KIM) Nominated Discussion: Verdict "malicious" and action "allow" (KIM)   Stay in the Loop   Be sure to subscribe to our News section to stay up-to-date on LIVEcommunity news, updates, and more!    ... View more

  Cybersecurity for the AI Era 2023 was a breakthrough year for AI, and enterprises around the world now find themselves on the crest of a new wave of disruption. Organizations are ramping up investments in AI, particularly in generative AI, to increase automation, improve content creation, and enhance customer and employee experiences.    Gaylord Rockies Resort & Convention CenterBut AI is a double-edged sword, benefiting businesses and cybercriminals alike. As AI-powered attacks become a part of everyday life, businesses, governments, and individuals must turn to emerging technologies, such as AI and ML, to generate their own automated responses. Discover a new approach to cybersecurity for the AI era at Ignite on Tour Denver. Bringing Ignite to Your Doorstep Ignite on Tour brings cybersecurity practitioners and decision makers together for one exciting day packed with inspiring thought-leadership keynotes, hands-on workshops and technical breakouts, and networking opportunities.    Discover How You Can Harness AI to:   Solve for tomorrow’s SecOps challenges today Enable cloud transformation and deployment Accelerate incident response and speed investigations Apply best-in-class network security Secure hybrid workforces consistently and at scale Defend mobile networks and IoT devices   Join us at Ignite where you'll find the Livecommunity team with some awesome swag, and a chance to snag some cool prizes!     Tuesday, June 11, 2024     Register now to secure your spot!                           ... View more

  Delve into Fuel User Group, the sister community to LIVEcommunity, tailored for Palo Alto Networks users. Free membership in Fuel brings a myriad of benefits tailored to your interests and needs, particularly if you're immersed in cybersecurity or IT operations within the domain of Palo Alto Networks offerings   What’s really cool about Fuel User Group is that they consistently host Spark User Summits! Spark User Summits are live, virtual events that have been very popular for cybersecurity practitioners. These user summits are held regularly around the globe, bringing together members of the local Fuel User Group community to learn and collaborate on solving critical security issues.   The latest Spark User Summit took place on May 23, 2024, and focused on AI in the Age of Cybersecurity. We had a fantastic turnout and want to ensure you have access to the recording and presentation in case you missed them.     Meet the Speaker     Robert Rachwald has been in cybersecurity for more than 20 years including two IPOs and six acquisitions. Currently, Rob manages portfolio strategy for Palo Alto Networks. Rob joined Palo Alto Networks through the acquisition of Expanse in 2020. Prior to Expanse, Rob led marketing at several start ups including ShieldX (acquired by Fortinet), RedOwl (acquired by Fortinet) and also helped take FireEye and Imperva public. Robert holds a Bachelor's degree from UC Berkeley. Rob is an amateur Sommelier and has completed Wine & Spirit Education Trust (WSET) Level 3 training.           Watch Now! You can find the recording on the LIVEcommunity Youtube Channel: AI in the Age of Cybersecurity . Be sure to visit the Fuel User Group website to stay up-to-date on any upcoming events and topics!    Are You a Member Yet? Becoming a member of the Fuel User Group is a beneficial investment for individuals and organizations utilizing Palo Alto Networks products and services. As a reminder, Membership is free and offers access to a wealth of resources, including knowledge, training, virtual test labs, networking opportunities, and tools, which can significantly improve proficiency and effectiveness in cybersecurity and IT operations.   Additional Information Have topics that you’d like to hear about in the future? Submit your ideas here!    Curious to learn more about Fuel? Explore the Fuel website for details on their different chapters, events, and more!   Feel free to share your questions, comments and ideas in the section below or email [email protected] with questions and comments! ... View more

  Join us at InterSECt 2024, a 2-hour fully virtual experience, where industry leaders, tech visionaries and cybersecurity professionals gather at the intersection of security and innovation.   What is InterSECt? Since our first conference in 2023, InterSECt has become Palo Alto Networks premier network security conference, bringing together industry leaders, tech visionaries and cybersecurity professionals to discuss the future of network security. Event topics can range from cloud-delivered security services to software firewalls and SASE.   What are the benefits? You’ll learn how the latest advancements in SASE are leveraging the power of AI to deliver industry-leading security, while meeting complex user and operational needs to drive meaningful results:   How enterprise browsers are redefining the SASE landscape How AI-powered data security can prevent data loss from GenAI apps How intelligence augmentation can help achieve faster and better security outcomes How to improve user experience with 5x faster application acceleration   Who should attend? InterSECt 2024 is designed for decision-makers and practitioners responsible for IT security, networking, data and compliance leaders. Our goal is to provide cutting-edge insights and pragmatic recommendations to help accelerate network security, operations and business outcomes for organizations.   What are the dates for InterSECt 2024? We’ll broadcast InterSECt 2024 in three regions/time zones on June 4, 5 and 6:   AMERICAS: June 4 | 10 A.M. PDT EUROPE, MIDDLE-EAST & AFRICA: June 5 | 10 A.M. CEST ASIA-PACIFIC & JAPAN: June 6 | 9:00 A.M. IST | 11:30 A.M. SGT | 12:30 P.M. JST   See how Prisma SASE is redefining expectations and disrupting today’s digital modern workforce by attending InterSECt 2024.  We look forward to seeing you there!   Register now to secure your spot!     ... View more

Comment down below if you attended Ignite on Tour: Phoenix and what you liked about it!     **Comments now closed - thank you to those who participated in the discussion area!** ... View more

  This blog written by Erez Felman Der on May 09, 2024.     Organizations face increasingly sophisticated cyberattacks in today's rapidly evolving threat landscape. Attackers leverage common tools and living-Off-the-Land binaries (LOLBins) to blend in with typical network traffic. Defenders struggle to differentiate between benign and malicious actions in logs.   To help improve detection and reduce false positives, Cortex XDR uses analytics rules to generate alerts for suspicious behavior involving an unsigned PsExec-like remote execution of a LOLBin command. Once an alert is generated, a short and critical window exists to review and analyze it, enrich relevant information, and produce indicators of compromise (IOCs) to mitigate the event.   The Cortex XDR - Remote PsExec with LOLBin command execution alert playbook enables organizations to automate and expedite alert handling.     The Playbook   This playbook is part of the Cortex XDR content pack. It offers a comprehensive solution to improve and simplify the difficult task of collecting vital information, examining, and analyzing alerts associated with remote command line execution. These alerts can be especially challenging to identify because they may look like legitimate commands.   When an alert triggers the playbook, it starts by checking if the command execution was blocked by XDR, and if not, it will run a command to terminate the suspicious process activity. This provides an automated and immediate response action in case the process is not blocked.   Fig 1: Auto-termination of suspicious processes   Enrichment   Next, using any available integrations, it gathers information and enriches entities such as file hashes and IP addresses related to the alert to provide more details about the detected action.   After enriching the alert entities, the playbook continues to investigate and analyze all the gathered information to try and decide whether the alert is a false positive or requires further actions from the analyst.   Investigation & Analysis   During this stage of the investigation, the command line used in the suspicious execution is analyzed to determine if it contains any other malicious parameters, such as obfuscated network parameters, antimalware scan interface (AMSI) evasion techniques, or obfuscated base64.   Additionally, an endpoint investigation is conducted to identify any related alerts and logs that may be linked to the incident. This information can help the analyst gain a better understanding of the situation as a whole.   Based on the results uncovered during this stage, the severity of the incident may be updated. Furthermore, any evidence that is discovered is tagged and documented in the incident report for future reference.   Fig 2: Investigation and analysis portion of the playbook   Remediation   Finally, during the remediation stage, if the alert is classified as malicious, an auto-remediation will block all found indicators or wait for an analyst to review the findings and perform it manually according to the playbook's configuration.   Fig 3: Auto-remediation based on alert classification   Conclusion   By adopting this playbook, organizations can equip their analysts with a streamlined and automated process, ensuring efficient handling of these alerts while minimizing complexity.   These updates are now available via our Cortex Marketplace for Cortex XSOAR and Cortex XSIAM, as part of the Core - Investigation and Response content pack.   Ready for a test-drive? Request a demo today!   ... View more