Listing PCAP rules

dgagnon — Mon, 25 Apr 2022 16:33:50 GMT

Does anyone know if there's a way to search for rules within the Palo Alto which have packet capture enabled? I'm trying to see what rules currently collect PCAP and disable the collection of pcap data for noisy signatures.

Re: Listing PCAP rules

Adrian_Jensen — Mon, 25 Apr 2022 19:32:43 GMT

The packet capture settings for threats are defined in profiles which define the threat level and whether to capture a packet or not. You can create a custom profile rule and/or add exceptions for specific signatures. I am not aware of packet capture settings anywhere else... though there may be:

Objects -> Security Profiles -> Anti-Spyware

Objects -> Security Profiles -> Vulnerability Protection

topic Listing PCAP rules in General Topics

Listing PCAP rules

Re: Listing PCAP rules