Content s and Apps Updates

[jeff6strings]

We have two 3050 units managed by Panorama. I have two related questions: What is the difference between Apps and Contents in Dynamic Updates?  If we have a support contract for the firewalls and Panorama but don't subscribe to Antivirus, Threats and Wildfire do we need Content updates or just Apps?

Thanks for any help.

Jeff

[acc6d0b3610eec313831f7900fdbd235 · Accepted solution]

@jeff6strings Palo Alto provides three different subscriptions:

1. Threat Prevention: Anti-Virus, Anti-Spyware, Vulnerability Protection (IPS), File Blocking;

2. URL Filtering;

3. WildFire;

The main difference between App and Content is that the dynamic update

• App: Updates only the the App-ID signatures
• Content: Updates all the other features depending on the subscription you may have such as the ones I describe below.

It is important to note, that App-ID is a built-in core feature capability in the Palo Alto platform, and does not require a subscription in order to operate or get updated; However, when you purchase a Palo Alto firewall, the support is mandatory in order to get access to TAC for example, and be able to download the App (App-ID) updates.

The same is valid for the WildFire. For customers who do not have a WildFire subscription, they still can take advantage of the feature, and receive updates as well; however, non-subscribed customers can only upload Executable files to the Threat Intelligence cloud, while subscribed customers, can upload all supported file types such as PE, MS-Office, Flash, JAR, MACOSX etc.

The following content updates are available, depending on which subscriptions you have:

• Antivirus—Includes new and updated antivirus signatures, including signatures discovered by the WildFire cloud service. You must have a Threat Prevention subscription to get these updates. New antivirus signatures are published daily.
  
  
• Applications—Includes new and updated application signatures. This update does not require any additional subscriptions, but it does require a valid maintenance/support contract. New application updates are published weekly.
  
  
• Applications and Threats —Includes new and updated application and threat signatures. This update is available if you have a Threat Prevention subscription (and you get it instead of the Applications update). New Applications and Threats updates are published weekly.
  
  
• GlobalProtect Data File —Contains the vendor-specific information for defining and evaluating host information profile (HIP) data returned by GlobalProtect agents. You must have a GlobalProtect portal and GlobalProtect gateway license in order to receive these updates. In addition, you must create a schedule for these updates before GlobalProtect will function.
  
  
• BrightCloud URL Filtering —Provides updates to the BrightCloud URL Filtering database only. You must have a BrightCloud subscription to get these updates. New BrightCloud URL database updates are published daily. If you have a PAN-DB license, scheduled updates are not required as devices remain in-sync with the servers automatically.
  
  
• WildFire—Provides near real-time malware and antivirus signatures created as a result of the analysis done by the WildFire cloud service. Without the subscription, you must wait 24 to 48 hours for the signatures to roll into the Applications and Threat update.

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/getting-started/manage-content-updat...

I hope this helps.

[jeff6strings]

Thank you for the response and it was very helpful.

Jeff