topic Re: What would this number be at the end of some signatures? in General Topics

What would this number be at the end of some signatures?

fdagan96 — Tue, 10 Oct 2023 20:57:57 GMT

Guys, I saw that there is a different number sometimes in the same signature. What would that be? what is it for? Is there any documentation talking about it?
If I block the subscription with a number and another one appears with another number, do I have to do this blocking too or do these numbers not interfere with the subscription blocking and just put the name?

example:

1- DESCRIPTION AndroxGh0st Scanning Traffic Detection(86759)
2- DESCRIPTION AndroxGh0st Scanning Traffic Detection(86760)

If you can help me with these questions, please!

Thank you for your attention!

Re: What would this number be at the end of some signatures?

JayGolf — Wed, 11 Oct 2023 03:32:40 GMT

Hi @fdagan96,

These numbers represent the version number of the signature. In this case, "DESCRIPTION AndroxGh0st Scanning Traffic Detection(86760)" is the later version of the signature. You don't need to manually block each version as the latest threat updates include the most recent signatures.

Re: What would this number be at the end of some signatures?

fdagan96 — Wed, 11 Oct 2023 13:01:08 GMT

Thanks a lot for the help!

Re: What would this number be at the end of some signatures?

ymiyashita — Tue, 17 Oct 2023 01:14:35 GMT

Those are Unique Threat IDs.
https://threatvault.paloaltonetworks.com/?query=86759&type=

https://threatvault.paloaltonetworks.com/?query=86760&type=

Sometimes, multiple PoCs (Proof of Concept) exist for a particular vulnerability.
In other words, there are multiple ways to detect the threat. So, it's normal to see more than one signatures for the same vulnerability.
Even if the Threat name is the same, the detection logics are different.

The Security Profile is basically configured to block threats based on the Severity (not the ID).
Please refer to the Security Policy Best Practice.
https://docs.paloaltonetworks.com/best-practices/security-policy-best-practices/security-policy-best-practices/deploy-security-policy-best-practices/security-policy-rule-best-practices

The ID can be used when you want to set an exception.
- How to Use Anti-Spyware, Vulnerability and Antivirus Exceptions to Block or Allow Threats
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcrCAC