topic Re: Can I make a virus security-profile excepted all w.generic signatrues? in General Topics

Can I make a virus security-profile excepted all w.generic signatrues?

KiCheon.Lee — Mon, 22 Sep 2014 08:43:05 GMT

Hello

My customer think all w.generic virus signarues would have false-positive.

So he want to make a virus profile excepted all w.generic signatures.

Can it be made?

Thanks.

Re: Can I make a virus security-profile excepted all w.generic signatrues?

Jacobwebb — Mon, 22 Sep 2014 11:28:26 GMT

Hi Cheon,

This can be done, but you will have to add the threat ID for each virus into the exceptions list. How to Add a Threat Exceptions explains how you can go about doing this.

Regards,

- Jacob

Re: Can I make a virus security-profile excepted all w.generic signatrues?

hshah — Mon, 22 Sep 2014 12:53:27 GMT

Hi Cheon,

Following document will help you to create exception for desired thread.

How to Add a Threat Exceptions

Well, W.generic signature are basically wild-fire push. So, it will remain for may be 24 hours and then permanently installed on firewall through anti-virus update.

Regards,

Hardik Shah

Re: Can I make a virus security-profile excepted all w.generic signatrues?

hshah — Mon, 22 Sep 2014 17:17:08 GMT

Hi Cheon,

So basically whatever changes you do will not last for more than 2 days. Because those updates will have newer name and id after two days.

Let me know if this helps.

Regards,

Hardik Shah

Re: Can I make a virus security-profile excepted all w.generic signatrues?

KiCheon.Lee — Tue, 23 Sep 2014 02:44:36 GMT

Thanks for your answer, Jacob and Hardik Shah.

I already knew a way how to add a threat exception. But this method is I have to add each threat-IDs.

My customer wants to add some automatic method.

Do you know the ranged of w.generic virus signature IDs???

Thanks,

KC Lee

Re: Can I make a virus security-profile excepted all w.generic signatrues?

hshah — Tue, 23 Sep 2014 04:15:01 GMT

Hi Cheon,

Following document has requested information.

Threat ID Ranges in the Palo Alto Networks Content Database

Basically WF IDs are :

PE: 2000000 - 3000000
PE (WildFire): 3000000 - 3100000

Let me know if this helps.

Regards,

Hardik Shah

Re: Can I make a virus security-profile excepted all w.generic signatrues?

hshah — Tue, 23 Sep 2014 13:11:21 GMT

Hi Cheon,

Let me know if this was helpful.

Regards,

Hardik Shah

Re: Can I make a virus security-profile excepted all w.generic signatrues?

KiCheon.Lee — Thu, 25 Sep 2014 05:24:07 GMT

Hi hshah,

Thanks you for your answer.

are All WildFire signatures for PE made up w.generic???

And Is it possible that add range Virus IDs to virus exception?

Regards,

KC Lee

Re: Can I make a virus security-profile excepted all w.generic signatrues?

HULK — Thu, 25 Sep 2014 06:19:19 GMT

Hello KC Lee,

Ans:1 I don't think all signatures for PE made up w.generic. Below is an example for different PE Virus Signatures.

FYI: WF IDs are :

PE: 2000000 - 3000000
PE (WildFire😞 3000000 - 3100000

Ans:2 You have to add indivisual virus exception into the profile and no options available to add a range of Virus IDs for virus exception.

Hope this helps.

Thanks

Re: Can I make a virus security-profile excepted all w.generic signatrues?

hshah — Thu, 25 Sep 2014 17:27:44 GMT

Hi Cheon,

There is no mechanism to do mass exception for virus IDs.

However, you may want to add exception for 1 virus Id, then check configuration changes from CLI.

Copy config in notepad, edit it for number of IDs and put it in CLI. Its just a idea. You will have to work on it.

Regards,

Hardik Shah