Prisma Access: DNS Sinkhole

Create a Custom Application for traffic towards augloop.office.com as Prisma Access identifies this as a WebSocket connection and fails to insert HTTP headers.

Select Manage → Configuration → NGFW and Prisma Access → Objects → Applications. Select the Prisma Access configuration scope.

Click Add Application and name as augloop, then select the basic properties as per the below values:

Category → general-internet
Subcategory → internet-utility
Technology → client-server
Parent App → ms-office365-copilot
Risk → 1

Go to the Advanced tab and select Port, then add the port information as below:

tcp/443
tcp/80

Go to the Signatures tab and click Add, then configure the following settings:

Name → AugloopSig
Scope → Session
Add ‘And Condition’ and input name as ‘And Condition 1’

Add ‘Or Condition’ and input name as ‘Or Condition 1’\
Operator → Pattern Match
Context → http-req-headers
Pattern → (augloop.office.com) and Update

Create a Custom Application for traffic towards substrate.office.com as Prisma Access identifies this as a WebSocket connection and fails to insert HTTP headers.

Select Manage → Configuration → NGFW and Prisma Access → Objects → Applications. Select the Prisma Access configuration scope.

Click Add Application and name as substrate, then select the basic properties as per the below values:

Category → general-internet
Subcategory → internet-utility
Technology → client-server
Parent App → ms-office365-copilot
Risk → 1

Go to the Advanced tab and select Port, then add the port information as below:

tcp/443
tcp/80

Go to the Signatures tab and click Add, then configure the following settings:

Name → SubstrateSig
Scope → Session
Add ‘And Condition’ and input name as ‘And Condition 1’
d. Add ‘Or Condition’ and input name as ‘Or Condition 1’
Operator → Pattern Match
Context → http-req-headers
Pattern → (substrate.office.com) and Update

DNS Security

Create a DNS Security Profile to redirect any DNS request matching the WitnessForwardDomainList EDL to the WitnessAI proxy.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → DNS Security. Select the Prisma Access configuration scope.

Click Add Profile to set the following settings:

Name → WitnessAI_Sinkhole
DNS Categories → Set the Policy Action as sinkhole for WitnessForwardDomains
Sinkhole IPv4 → Enter the IP after resolving [tenantID].[region].witness.ai and Save

HTTP Header Insertion

Configure HTTP Header Insertion to insert the user email address in the X- Authenticated-User Header field before forwarding the traffic to Witness AI proxy.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → HTTP Header Insertion. Select the Prisma Access configuration scope.

Click Add Profile to set the following settings:

Name → X-Auth-User

Click Add Rule to set the following settings:

Name → X-Auth-User Header
Type → Dynamic Fields
Domain → *
Add Headers → X-Authenticated-User
Value → ($user)@($domain)
Tick the Log box and Save

URL Access Management

This will ensure URL filtering logs are created for any traffic matching WitnessForwardURLList EDL domains.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → URL Access Management. Select the Prisma Access configuration scope.

Click Add Rule to set the following settings:

Name → WitnessAI_allow
Under External Dynamic Lists, select WitnessForwardURLList and change Site Access to alert.

Profile Groups

Attach HTTP Header Insertion Profile and URL Access Management Profile to the Profile Group.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Profile Groups. Select the Prisma Access configuration scope.

Click Add Rule to set the following settings:

Name → WitnessAI PG
Under URL Access Management Profile, select WitnessAI_allow
Under HTTP Header Insertion Profile, select X-Auth-User and Save

Attach DNS Security Profile to a Profile Group.

Click Add Profile Group to set the following settings:

Name → WitnessAI_Sinkhole PG
Under DNS Security Profile, select WitnessAI_Sinkhole and Save

Security Policy

i. Create Security Policy to block Quic

Quic is a Google developed protocol which uses UDP for web connections and limits the firewall visibility and ability to analyze and apply security actions.

If the Quic protocol is not already blocked, please perform below steps.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Security Policy. Select the Prisma Access configuration scope.

Click Add Rule → Security Rule (Pre Rule) to set the following settings:

Pre-rules are global rules that take precedence over deployment-specific rules and are applied to traffic first.

Name → Quic Block

Source Zone → trust

Destination Zone → untrust

Application → quic

Action → Deny and Save

ii. Create Security Policy for DNS Sinkhole

Attach the WitnessAI_Sinkhole PG profile group in this policy and place the rule above the standard DNS allow rule.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Security Policy. Select the Prisma Access configuration scope.

Click Add Rule → Security Rule (Pre Rule) to set the following settings:

Name → WitnessAI_Sinkhole

Source Zone → trust

Destination Zone → untrust

Application → dns

Profile Group → WitnessAI_Sinkhole PG

Log Settings → Untick ‘Log at Session Start’ and ‘Log at Session End’

Action → Allow and Save

Note: It is possible to restrict the user scope for slow rollout/PoC testing using ‘User Groups’ as Source Criteria.

iii. Create Security Policy for allowing traffic to WitnessAI Proxy.

Attach the WitnessAI PG profile group with this policy. This rule will insert the HTTP header and generate the URL filtering logs for the traffic towards WitnessForwardURLList.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Security Policy. Select the Prisma Access configuration scope.

Click Add Rule → Security Rule (Pre Rule) to set the following settings:

Name → WitnessAI_Allow

Source Zone → trust

Destination Zone → untrust

URL Category → WitnessForwardURLList

Profile Group → WitnessAI PG

Action → Allow and Save

10. Create Decryption Profile & Policy

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Decryption. Select the Prisma Access configuration scope.

Click Add Profile to set the following settings:

Decryption Profiles → Name → Witness-Decrypt Profile

SSL/TLS Decryption → Advanced → Enable Strip ALPN

The Palo Alto Firewall supports header insertion for HTTP/1.x traffic only; it does not support header insertion for HTTP/2 traffic.

SSL/TLS Decryption → Select Protocol Min Version as TLSv1.0 and Protocol Max Version as Max, and Save

Create a new Decryption Policy to decrypt WitnessForwardURLList URL category. Make sure this is placed above the ‘O365-Best-Practice’ rule or any other SSL Decryption Bypass rules.

Click Add Rule to set the following settings:

Name → WitnessAI_Decrypt

Source Zone → trust

Destination Zone → untrust

URL Category Entities → WitnessForwardURLList

Action → Decrypt

Type → SSL Forward Proxy

Decryption Profile → WitnessAI_Decrypt Profile

11. Push Config

The last step is to push the changes to the Prisma Gateways. Click Push to enable the configuration changes made.

Prisma Access Integration: DNS sinkhole DNS Sinkhole Traffic Flow DNS Sinkhole Configuration Install WitnessAI Root Certificate Setup EDL Certificate Profile Create External Dynamic Lists Create Custom Application for Office DNS Security HTTP Header Insertion URL Access Management Profile Groups Security Policy i. Create Security Policy to block Quic ii. Create Security Policy for DNS Sinkhole iii. Create Security Policy for allowing traffic to WitnessAI Proxy.10. Create Decryption Profile & Policy 11. Push Config