"Hello from Palo Alto Networks" User Agent: Cortex Xpanse Scans

Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity

What it is

The user agent that begins Hello from Palo Alto Networks belongs to Cortex Xpanse, Palo Alto Networks’ attack surface management service. Its scanning page says Xpanse takes “an outside-in approach to network security and asset management” and continuously scans the global internet “to monitor our customers’ internet-facing attack surface and discover emerging threats”. The header itself carries the address of that page, so the scan explains itself to anyone who reads the log.

On our own server, Xpanse sent about a hundred and thirty requests in the last 30 days from about ninety addresses — one or two each — and asked only for / and /v1/metadata (counts above).

Who sends it

Palo Alto Networks. The scanning page lists the IPv4 and IPv6 ranges the scans use, and gives [email protected] as the contact for suspected abuse associated with Cortex Xpanse scans. Like other internet-wide scanners, it visits servers whether or not their owner is a customer, because finding a customer’s assets means looking everywhere. The header can be copied by anyone, so the published ranges are also the way to confirm a request really came from Xpanse: a request with this user agent from an address outside them is someone borrowing the name.

Is it a threat?

No. It is announced, documented reconnaissance (MITRE ATT&CK T1595, active scanning) by a security vendor, with a small request footprint. What it records is what any scanner can see; if Xpanse finds a forgotten service on your network, so can anyone else.

How to handle it

1. Treat the requests as informational. Palo Alto suggests marking its ranges as non-malicious in your tools so that you stop getting alerts.
2. If you want no part of it, its page suggests configuring your firewall to drop traffic from the published ranges; an address block also covers its non-HTTP connections.
3. Use the reminder: list what your server exposes and close what should not be public.

Count the requests and see what they asked for:

grep 'Palo Alto Networks' /var/log/nginx/access.log | awk '{print $9, $7}' | sort | uniq -c | sort -rn

Keep its HTTP requests out of your application if you prefer (server block); the firewall drop is the thorough option:

if ($http_user_agent ~* "palo alto networks") {
    return 403;
}

For the requests in the same log that do not announce themselves, see the web probe reference and the free log analyzer.