Ira Glass

Block

Open XDR Investigation

Profile

Name
Username
Email
Location
Current Time
Manager

Security Info

Risk Score
Incidents/Investigations
Alerts
Tags
Notes

Recent Activity

Generic Template of PDF Exploits

View Logs View in AutoFocus

Block

Open XDR Investigation

Overview

ID

33546

Description

This signature indicates a malicious pdf file trying to drop and run an embedded spyware

Severity

High

Subtype

Unknown

AutoFocus Tags

Security Info

Risk Score
Incidents/Investigations
Alerts
Tags
Notes

Analysis

All Apps 215
New 7
Apps with Poor Characteristics 28

7 applications in filter set

Filter Selected

Exclude Selected

Application	Risk	Bytes	Sessions	Threats	Content	URLs	Users
gnutella	5	2.1G	83.7K	167	240	48.7K	1.1K
scribd-base	3	1.8G	77.4K	183	282	55.3K	1.0K
lorem-ipsum	3	1.8G	77.4K	183	282	55.3K	1.0K

Application	Risk	Bytes	Sessions	Threats	Content	URLs	Users
web-browsing	4	2.1G	83.7K	167	240	48.7K	1.1K
rapidshare	4	1.8G	77.4K	183	282	55.3K	1.0K
loremipsum	4	1.8G	77.4K	183	282	55.3K	1.0K

Workday

Sanctioned

Allowed

business systems > general-business

Add to Application Group

Classify As...

Managed through Aperture

(Info/links/actions?)

Description

Workday, Inc. is an on-demand (cloud-based) human capital management and financial management software vendor. It targets the customers of rivals Oracle or SAP by offering them "online services at a fraction of the cost of upgrading from their incumbent vendors".

Link to website, links to Wikipedia and other references

Sanctioned Info

Edit

Sanctioned By

HR

Administrators

ntotenberg

Date Sanctioned

License

Etc.

Salesforce

Sanctioned

Partially-Blocked

Networking > erp-crm

Add to Application Group

Classify As...

Policy Overview

High-level picture of user access and limitations/protections in place.

Allowed for approx. 1200 users
Blocked on unmanaged devices
Malware protection is ON

Allow

Block

Users

Approx 1100 users have access

Finance

900

Executives

50

IT

90

alixspiegel

1

claudiosanchez

1

lulugarcianavarro

1

nealzuckerman

1

ninatotenberg

1

pattineighmond

1

jimzarolli

1

All other users

Devices

Blocked on Unmanaged Devices

All other devices

Unmanaged Devices

300

Locations

No location restrictions

Content

No content restrictions

Activity

No activity restrictions

Description

Salesforce.com is an on-demand Customer Relationship Management (CRM) solution vendor.

Link to website, links to Wikipedia and other references

Sanctioned Info

Edit

Sanctioned By

Sales

Administrators

ntotenberg

Date Sanctioned

License

Etc.

General

Session ID

230962

Action

Allow

Action Source

from-policy

Rule

ANY

IP Protocol

tcp

Source

User

Address

10.0.0.0-10.255.255.255

Port

59978

Zone

pm wifi

Interface

vlan.550

Details

Type

end

Bytes

933

Bytes Received

326

Bytes Sent

607

Repeat Count

1

Packets

12

Packets Received

5

Packets Sent

7

Destination

User

paloaltonetwork\spoggioli

Address

10.0.130.34

Country

10.0.0.0-10.255.255.255

Port

17472

Zone

untrust

Interface

vlan.551

Flags

Captive Portal

No

Proxy Transaction

Yes

Decrypted

Yes

Packet Capture

Yes

Client to Server

No

Server to Client

Yes

Symmetric Return

No

Mirrored

No

Tunnel Inspected

No

MPTCP Options

Yes

Recon Excluded

Yes

Users

Devices

Locations

Content

Activity

General

Source

Details

Destination

Flags

Ira Glass

Generic Template of PDF Exploits

Bittorrent

Detail: Appilcation Category

Apps with Poor Characteristics

App Subcategories 19

Applications 215

Source Regions 93

Destination Regions 89

Users 129

Rules 516

Threat Activity 381

Network Activity

Ira Glass

Generic Template of PDF Exploits

Bittorrent

file-sharing

Detail: Appilcation Category

Apps with Poor Characteristics

App Subcategories 19

Applications 215

Source Regions 93

Destination Regions 89

Users 129

Rules 516

Threat Activity 381