I want to block PotatoVPN ( Threat ID 86751 )

Scott_McCambley — Mon, 18 Sep 2023 18:44:22 GMT

I want to be able to block PotatoVPN Traffic. I am successful in most of my other VPN threat hunting safaris but this one is fairly new and my current rules don't capture this little guy. Has someone out there created a policy that successfully blocks potatovpn.

Can I create a policy rule simply off of the identified threatID of potatovpn which Paloalto logs properly? I have never done this before. PotatoVPN is not in the Applicpedia database to choose it by appid

Thanks

Re: I want to block PotatoVPN ( Threat ID 86751 )

Claw4609 — Mon, 18 Sep 2023 20:32:10 GMT

You can override the default action of signatures in the anti-spyware profile from, in this case, "alert" to whatever youd like. Does this address what you need?

Edit adding more specifics: You can go to the signature exceptions tab of an anti-spyware profile, then select the show all signatures check box in the bottom left, find the signature you are looking for and change the action to what you would like, and make sure to select the enable check box on the signature itself for any signatures you edit. Then apply this anti-spyware profile to the rules you'd like, either directly or through a security profile. This is also all under the assumption you have a threat protection license.

topic I want to block PotatoVPN ( Threat ID 86751 ) in General Topics

I want to block PotatoVPN ( Threat ID 86751 )

Re: I want to block PotatoVPN ( Threat ID 86751 )