Test that a Threat Signature is Enabled?

L0 Member

Test that a Threat Signature is Enabled?

Hello,

 

Is there a way of testing if a specific Threat Signature is enabled? I recently automated critical threat signatures. both vulnerabilities and anti-spyware, to be set to reset-both, but I want to make sure it is working and the new critical signatures are indeed enabled and ready to reset-both. I have done some random searches and haven't been able to find one that has been hit and I really don't want to take the wait and see approach here.  Thoughts?

 

Kim

Highlighted
L6 Presenter

Re: Test that a Threat Signature is Enabled?

The best way to test it would be to run a pentest. Obtain the proof of concept (PoC) and run the exploit through the box. If it doesn't fire, that would be a great false negative finding and you should report it, providing a full client packet capture and details on the PoC to Palo Alto Networks Support, to review how the signature needs to be improved.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!