False positive detection

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

False positive detection

L0 Member

I'm representing a productivity management software manufacturer and I'm sumbitting this request  to report that our software is being flagged as malware, but this result is a false positive. Please, can you help us?



L4 Transporter

Hi Gdomenech,

you can add your legit software signer as a trusted signer. Second choice will be to add that hash to the allow list. 


Hi Luis,


We are not clients of Palo Alto but some of our clients are clients of yours and have the false positive detection problem. Is there a way you can fix it globally?





L5 Sessionator

Hi @gdomenech the ideal process is to get your clients to raise a support ticket at https://support.paloaltonetworks.com/ with the details of the alert (tenant ID, alert ID, incident ID, signer, hash etc.). That'll make sure that the problem is documented and resolved though the standard channels for a global fix. 


As tactical fixes, as @eluis has mentioned, your customer can allow the hash. Allowing the hash is a one-time process, and your clients might run into the same problem when a new version of the software is released. Similarly, allowing the signer is a broad-based control and I wouldn't recommend that either as a systemic fix.


Thanks, We will ask our customers to raise a support ticket.

  • 4 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!