Signature Policy in Anti Spyware Profile

rajumaharjan — Tue, 28 Sep 2021 05:49:08 GMT

What does Signature policy in Anti Spyware do, and what does "Default" in Action do.

Re: Signature Policy in Anti Spyware Profile

PavelK — Tue, 28 Sep 2021 06:24:00 GMT

Thank you for posting question @rajumaharjan

The Anti-Spyware policy called: "default" comes automatically after you install Threat Prevention license and install the Application and Threat package. Not licensed Firewalls have this profile as well, however there is a message: "Threat Prevention License required for antivirus, anti-spyware, and vulnerability protection to function". The action default simply means that it will take default action based on signature. For example if signature has default action: (reset-both) it will send TCP RST to client and server. If the signature has default action: (alert) it will only make record in Threat log. You can see all the signature by going to: Exceptions and clicking on: show all signatures.

If you want to get more information about signature you can go to: https://threatvault.paloaltonetworks.com/ then search for signature based on name, threat id,... From here you can see more information for example when and in what Threat package it was released.

Note: Unless you link the Anti-Spyware profile into: Security Profile Group and this group assign to security policy, it will not have any effect.

Kind Regards

Pavel

Re: Signature Policy in Anti Spyware Profile

rajumaharjan — Wed, 29 Sep 2021 14:56:10 GMT

Thank you for the reply, got the answer.

topic Re: Signature Policy in Anti Spyware Profile in General Topics

Signature Policy in Anti Spyware Profile

Re: Signature Policy in Anti Spyware Profile

Re: Signature Policy in Anti Spyware Profile