topic Re: False Positive Virus PDF in General Topics

False Positive Virus PDF

Alpalo — Thu, 02 Dec 2021 12:03:04 GMT

Hello,
We are detecting that several PDFs that we share on our internal network are being detected as VIRUS.

As we have the antivirus profile enabled in a security rule the session is reset .

Does anyone know how I can avoid this?

Regards

Re: False Positive Virus PDF

kiwi — Thu, 02 Dec 2021 15:15:15 GMT

Hi @Alpalo ,

If this is a false positive you should gather the PCAP from the threat log and send it to support for analysis so they can get the signature fixed. If packet capture isn't enabled then you can enable it in the security profile.

As a workaround you can create an exception until the false positive is fixed:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/threat-prevention/create-threat-exceptions.html

Hope it helps,

-Kiwi.

Re: False Positive Virus PDF

OtakarKlier — Thu, 02 Dec 2021 20:27:05 GMT

Hello,

Also if its being detected as one of the 'generic' definitions, then most likely its a false positive. Happens from time to time as the generic definitions are quit broad.

Regards,