It’s almost like Tenable is trying to hide the documentation, almost every link on the Internet takes you to their documentation for the Tenable Cloud service! Either way to get to the REST API documentation go to /api path, if your server was at https://scanner.myworldofit.net:8443 you’d go to https://scanner.myworldofit.net:8443/api. Of note you can go to /api#/resources/session/create to enter the username/password… Read more
Category: Security
Palo Alto Networks NGFW fails to install AV or Wildfire updates even though Apps & Threats are up-to-date
On a firewall that’s been upgraded from the ‘non Advanced’ licences to the ‘Advanced’ licences and where the ‘non Advanced’ licences now show as expired in the licences page you may encounter the following message when trying to manually install Wildfire updates: Failed to update content with following message: rootdir changed to /opt/pancfg/mgmt/wf_ramdisk/wf_tmp No wildfire update is applied. No valid… Read more
Palo Alto Networks Decryption – Azure CLI won’t connect ‘[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier’
It looks like the more recent releases of Azure CLI are running off Python versions that enforce ‘Authority Key Identifier’ checks of the security certificates when connecting to Azure CLI (az login). You might see an error message similar to the below if bumping into this issue. HTTPSConnectionPool(host=’login.microsoftonline.com’, port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, ‘[SSL: CERTIFICATE_VERIFY_FAILED]… Read more
CITC 2026 Protecting High Risk Accounts with Strong (Phishing Resistant) Authentication
CITC is back for 2026 and this year I’m talking about how trivial it is to compromise identities and how to prevent it with phishing resistant authentication. Please see below the video presentation. Reference article links: The Register – Lock down Microsoft Intune, feds warn after Stryker attack – https://www.theregister.com/2026/03/19/microsoft_intune_lockdown_stryker/ The Register – 1K+ cloud environments infected following Trivy supply… Read more
Panorama PAN-OS 12.1 upgrade fails, ‘no enough disk space to hold image’
In getting ready to move Panorama to PAN-OS 12.1 from 11.1 (to manage some new PA-5×0 series firewalls) if you haven’t already performed the ‘224GB’ disk size increase you are likely to bump into this error message: Successfully downloaded Software version: 12.1.2 Preloading into software manager Failed to create required free space. Free space: 3191 MB, Required space: 3717 MB… Read more
Palo Alto Networks NGFW does not respond to ping from HPE Procurve/Aruba switches
Another unexpected Zone Protection Profile doing it’s thing – in this case sending a ping from an end-user device (such as Windows/macOS computer) to an IP interface (gateway) on a Palo Alto Networks Next Generation Firewall was coming back with a response, but requests from HPE ProCurve (Aruba) switches (2920/2530) appeared to disappear into oblivion with no response. A little… Read more
CITC 2025 Logging for disaster
By kind invite of the organising committee I had the pleasure of presenting at the CITC 2025 conference at the RAF Museum Hendon. Shaking things up even more from last year I not only presented from a GitHub repo but also managed to convince screen recording on my iPad mini to work to capture the slides. I’ve had to exclude… Read more
Graylog JSON extractor ‘skipping’ keys and values
In having a play with a general purpose way to get CSVs and other log data into Graylog with PowerShell I’ve been converting the files contents into JSON to then import over RAW HTTP – hardly the most speedy way but as a proof of concept it works. However, after configuring a JSON extractor (System > Inputs > (your input)… Read more
Users on Palo Alto GlobalProtect cannot connect to Citrix VDA
In investigating issues with users on GlobalProtect VPN not being able to connect to Citrix VDA servers I bumped into this forum post. In investigating I first disabled the Packet Based Attack Protection > IP Drop > Fragmented traffic at Network > Network Profiles > Zone Protection > Profiles for GlobalProtect and the zone hosting the Citrix application. While this… Read more
CITC 2024 Practical steps to help mitigate the risk of Zero-Day vulnerabilities
Something new for this year’s presentation at CITC, instead of your classic PowerPoint slides I’ve produced a GitHub repo with the intent on building out the knowledge and ideas presented overtime. GitHub repo: https://github.com/jamesfed/0DayMitigations/