Prisma Access: DNS Sinkhole

Certificate will be provided by the Account Team.
Go to Objects → Certificate Management and click on Import
Give the certificate name as Witness-AI-CA and upload the CA certificate by clicking on Browse
Go to Objects → Certificate Management → Certificate Profiles and click on Add Profile
Give the name as Witness-AI-CP and click on the Add button under CA Certificates
Select the Witness-AI-CA certificate and Save
Use this certificate Profile for the EDL Configuration.

Create External Dynamic Lists

This section will focus on creating the WitnessForwardDomainList, which are LLM domains that need to be forwarded to WitnessAI.

Select Manage → Configuration → NGFW and Prisma Access → Objects → External Dynamic List. Select the Prisma Access configuration scope.
Click Add External Dynamic List and enter the following configurations:

Name → WitnessForwardDomainList
Type → Domain List
Source → https://api.[tenantID].[region].witness.ai/v1/edls/forwardlist.txt
Certificate Profile → Witness-AI-CP
Check for Updates → Every Five Minute and Save

Click Add External Dynamic List and enter the following configurations:

Name → WitnessForwardURLList
Type → URL List
Source → https://api.[tenantID].[region].witness.ai/v1/edls/urllist.txt
Certificate Profile → Witness-AI-CP
Check for Updates → Every Five Minute and Save

Create Custom Application for Office

PaloAlto Firewall does not support HTTP header insertion for Web Socket traffic.

Create a Custom Application for traffic towards augloop.office.com as Prisma Access identifies this as a WebSocket connection and fails to insert HTTP headers.

Select Manage → Configuration → NGFW and Prisma Access → Objects → Applications. Select the Prisma Access configuration scope.
Click Add Application and name as augloop, then select the basic properties as per the below values:

Category → general-internet
Subcategory → internet-utility
Technology → client-server
Parent App → ms-office365-copilot
Risk → 1

Go to the Advanced tab and select Port, then add the port information as below:

tcp/443
tcp/80

Go to the Signatures tab and click Add, then configure the following settings:

Name → AugloopSig
Scope → Session
Add ‘And Condition’ and input name as ‘And Condition 1’

Add ‘Or Condition’ and input name as ‘Or Condition 1’\
Operator → Pattern Match
Context → http-req-headers
Pattern → (augloop.office.com) and Update

Create a Custom Application for traffic towards substrate.office.com as Prisma Access identifies this as a WebSocket connection and fails to insert HTTP headers.

Select Manage → Configuration → NGFW and Prisma Access → Objects → Applications. Select the Prisma Access configuration scope.
Click Add Application and name as substrate, then select the basic properties as per the below values:

Category → general-internet
Subcategory → internet-utility
Technology → client-server
Parent App → ms-office365-copilot
Risk → 1

Go to the Advanced tab and select Port, then add the port information as below:

tcp/443
tcp/80

Go to the Signatures tab and click Add, then configure the following settings:

Name → SubstrateSig
Scope → Session
Add ‘And Condition’ and input name as ‘And Condition 1’
d. Add ‘Or Condition’ and input name as ‘Or Condition 1’
Operator → Pattern Match
Context → http-req-headers
Pattern → (substrate.office.com) and Update

DNS Security

Create a DNS Security Profile to redirect any DNS request matching the WitnessForwardDomainList EDL to the WitnessAI proxy.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → DNS Security. Select the Prisma Access configuration scope.
Click Add Profile to set the following settings:

Name → WitnessAI_Sinkhole
DNS Categories → Set the Policy Action as sinkhole for WitnessForwardDomains
Sinkhole IPv4 → Enter the IP after resolving [tenantID].[region].witness.ai and Save

HTTP Header Insertion

Configure HTTP Header Insertion to insert the user email address in the X- Authenticated-User Header field before forwarding the traffic to Witness AI proxy.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → HTTP Header Insertion. Select the Prisma Access configuration scope.
Click Add Profile to set the following settings:

Name → X-Auth-User

Click Add Rule to set the following settings:

Name → X-Auth-User Header
Type → Dynamic Fields
Domain → *
Add Headers → X-Authenticated-User
Value → ($user)@($domain)
Tick the Log box and Save

URL Access Management

This will ensure URL filtering logs are created for any traffic matching WitnessForwardURLList EDL domains.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → URL Access Management. Select the Prisma Access configuration scope.
Click Add Rule to set the following settings:

Name → WitnessAI_allow
Under External Dynamic Lists, select WitnessForwardURLList and change Site Access to alert.

Profile Groups

Attach HTTP Header Insertion Profile and URL Access Management Profile to the Profile Group.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Profile Groups. Select the Prisma Access configuration scope.
Click Add Rule to set the following settings:

Name → WitnessAI PG
Under URL Access Management Profile, select WitnessAI_allow
Under HTTP Header Insertion Profile, select X-Auth-User and Save

Attach DNS Security Profile to a Profile Group.

Click Add Profile Group to set the following settings:

Name → WitnessAI_Sinkhole PG
Under DNS Security Profile, select WitnessAI_Sinkhole and Save

Security Policy

i. Create Security Policy to block Quic

Quic is a Google developed protocol which uses UDP for web connections and limits the firewall visibility and ability to analyze and apply security actions.

If the Quic protocol is not already blocked, please perform below steps.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Security Policy. Select the Prisma Access configuration scope.
Click Add Rule → Security Rule (Pre Rule) to set the following settings:

Pre-rules are global rules that take precedence over deployment-specific rules and are applied to traffic first.

Name → Quic Block
Source Zone → trust
Destination Zone → untrust
Application → quic
Action → Deny and Save

ii. Create Security Policy for DNS Sinkhole

Attach the WitnessAI_Sinkhole PG profile group in this policy and place the rule above the standard DNS allow rule.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Security Policy. Select the Prisma Access configuration scope.
Click Add Rule → Security Rule (Pre Rule) to set the following settings:
Name → WitnessAI_Sinkhole
Source Zone → trust
Destination Zone → untrust
Application → dns
Profile Group → WitnessAI_Sinkhole PG
Log Settings → Untick ‘Log at Session Start’ and ‘Log at Session End’
Action → Allow and Save

Note: It is possible to restrict the user scope for slow rollout/PoC testing using ‘User Groups’ as Source Criteria.

iii. Create Security Policy for allowing traffic to WitnessAI Proxy.

Attach the WitnessAI PG profile group with this policy. This rule will insert the HTTP header and generate the URL filtering logs for the traffic towards WitnessForwardURLList.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Security Policy. Select the Prisma Access configuration scope.
Click Add Rule → Security Rule (Pre Rule) to set the following settings:
Name → WitnessAI_Allow
Source Zone → trust
Destination Zone → untrust
URL Category → WitnessForwardURLList
Profile Group → WitnessAI PG
Action → Allow and Save

10. Create Decryption Profile & Policy

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Decryption. Select the Prisma Access configuration scope.
Click Add Profile to set the following settings:
Decryption Profiles → Name → Witness-Decrypt Profile
SSL/TLS Decryption → Advanced → Enable Strip ALPN

The Palo Alto Firewall supports header insertion for HTTP/1.x traffic only; it does not support header insertion for HTTP/2 traffic.

SSL/TLS Decryption → Select Protocol Min Version as TLSv1.0 and Protocol Max Version as Max, and Save
Create a new Decryption Policy to decrypt WitnessForwardURLList URL category. Make sure this is placed above the ‘O365-Best-Practice’ rule or any other SSL Decryption Bypass rules.
Click Add Rule to set the following settings:
Name → WitnessAI_Decrypt
Source Zone → trust
Destination Zone → untrust
URL Category Entities → WitnessForwardURLList
Action → Decrypt
Type → SSL Forward Proxy
Decryption Profile → WitnessAI_Decrypt Profile

11. Push Config

The last step is to push the changes to the Prisma Gateways. Click Push to enable the configuration changes made.

Prisma Access Integration: DNS sinkhole DNS Sinkhole Traffic Flow DNS Sinkhole Configuration Install WitnessAI Root Certificate Setup EDL Certificate Profile Create External Dynamic Lists Create Custom Application for Office DNS Security HTTP Header Insertion URL Access Management Profile Groups Security Policy i. Create Security Policy to block Quic ii. Create Security Policy for DNS Sinkhole iii. Create Security Policy for allowing traffic to WitnessAI Proxy.10. Create Decryption Profile & Policy 11. Push Config