topic Re: More granular with Vulnerability Exceptions? in General Topics

More granular with Vulnerability Exceptions?

jambulo — Tue, 16 Nov 2010 18:42:49 GMT

When adding a Vulnerability Exception, is there any way to make the exception more granular? (being able to add the exception along with an IP host or range, source or destination IP, zones, or virtual systems.) For example, If I wanted to ignore a certain vulnerability that is causing false positives and is coming from the inside of the network, I would have to add that vulnerability to the exceptions list. But by adding it to the list, I am also ignoring that vulnerability completely. I would like Palo Alto to still be able to monitor for that vulnerability, just not within certain parameters.

Re: More granular with Vulnerability Exceptions?

swhyte — Tue, 16 Nov 2010 22:13:48 GMT

Hello Jambulo,

the only way to do this is to create another vulnerability profile, add the desired exception, then create another policy that details your desired granularity (source ip, destination ip, etc..) and add that new vulnerability profile to it.

thanks,

Stephen

Re: More granular with Vulnerability Exceptions?

migration — Wed, 17 Nov 2010 14:09:06 GMT

Hi,

we would appreciate if you could consider this as a feature request or something to add in the future.

Every IPS solution has this possibility and granularity and we'd like to see it in PAN also.

It would be useful if the exception could be activated also by right-clicking on the interested log entry (as many vendor does)...

Thanks

Re: More granular with Vulnerability Exceptions?

jambulo — Wed, 17 Nov 2010 18:53:57 GMT

swhyte wrote:

Hello Jambulo,

thanks,

Stephen

Thanks for the tip...I tried it and it works, but have 2 concerns...

1) When I create a new policy that includes a specific IP address and the new vulnerability profile, it does work correctly at ignoring the vulnerability. BUT, ANYTHING that comes through with the IP address stated in the new policy, gets labeled as using the "rule" for that new policy. It looks like the policies are using a Bolean OR operator, when it should be using AND.

2) If I had to create multiple policies for multiple exceptions, would it create a lot of exta load? Since it scans through all the vulnerabilities minus the exception in Policy 1, then scans through all the vulnerabilities minus the exception in Policy 2, and so on...(I have Packet Capture on too)