Status of a given threat signature?

JimMcGrady — Mon, 13 Dec 2021 00:47:26 GMT

I'm running a 9.1 firewall with threat protection and wildfire. How do i check that a specific threat signature is turned on and blocking?

Re: Status of a given threat signature?

PavelK — Mon, 13 Dec 2021 01:27:24 GMT

Thank you for posting question @JimMcGrady

If signature is getting hit, you can check it in the Threat Log under: Monitor > Logs > Threat. You can narrow down to specific signature by this filter: ( threatid eq <signature ID>).

In order to check signature itself from Firewall navigate to: Objects > Security Profiles > AntiSpyware > [Profile Name] > Exceptions (Click: "Show All signatures"). You can filter the output to specific signature: ( id eq 'Sugnature ID' ). From here you can see default signature action under: "Action". If there is a rule that is overriding default signature action, you will see it under: "Rule".

You can use the same way to check Vulnerability Signatures.

Kind Regards

Pavel

topic Re: Status of a given threat signature? in Advanced Threat Prevention Discussions

Status of a given threat signature?

Re: Status of a given threat signature?