topic Re: App and Threat Threshold in General Topics

App and Threat Threshold

Schneur_Feldman — Fri, 11 Nov 2022 21:46:08 GMT

Team,

Can anyone please explain to me what the Threashold section does under Application and Threat updates?

I am so confused!

Re: App and Threat Threshold

OtakarKlier — Fri, 11 Nov 2022 22:05:20 GMT

Hello,

Its how old the package needs to be before its installed. Lets say its like the picture and set to 48 hours. While the PAN checks every 30 minutes, the package must be at least 48 hours old to be installed. This is to help minimize any accidental production goofs on the Palo alto side. I have mine set to check once a day, but the package must be at least 12 hours old.

Hope that makes sense.

Re: App and Threat Threshold

Metgatz — Fri, 11 Nov 2022 22:49:19 GMT

Hello @Schneur_Feldman

Hello, good afternoon.

The Threshold corresponds to the additional time. Example you have set every 30, but if you have 48 hrs, after 30 minutes, it will wait the hours you entered in Threshold in your case, example 48, to just perform the action you indicated, as in this case, download and install.

Best regards

Re: App and Threat Threshold

Schneur_Feldman — Sun, 13 Nov 2022 18:59:56 GMT

Thanks! So I guess the million dollar question is the Palo checking App and Threats every 30 minutes but just installing them after 48 hours?

I guess what I am confused about here is if there is any point in having the PA check every 30 minutes if its only installing after 48 hours??

Still kind of confused. Would anyone be able to explain the flow of a new package update and how that thresh hold effects it?

Re: App and Threat Threshold

Metgatz — Mon, 14 Nov 2022 00:24:13 GMT

Hello @Schneur_Feldman , it all depends on how you adjust it.

Some people prefer, once a new release comes out, well a new Update Dynamic, to wait before installing, to review and analyze, relying on the threshold set. There are those who prefer to just download and install every 30 minutes and not leave anything in the threshold. It all depends on your environments and scenarios.

Check these links related to Best Practices, but the choice should always be based on your choice, priority and environment:

-https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/software-and-content-updates/best-practices-for-app-and-threat-content-updates

Best regards