custom application of application cxceptions in antivirus profile

[paloalto.netfos]

Hi All

Can i use custom application in the application cxceptions of antivirus profile? I try seveval times, but still not find it in the application cxceptions of antivirus profile.

Is there any way to custom application in the application cxceptions of antivirus profile?

Thanks,

Joy

[mikand]

According to these docs (as I interpret them) custom apps wont be able to use URL, threat or anti-virus scanning engines.

Only custom apps which are based on already builtin apps will be able to do so:

Does application override adversely affect Threat ID?
https://live.paloaltonetworks.com/docs/DOC-2344

Application Override and Scanning Engines
https://live.paloaltonetworks.com/docs/DOC-1343

[paloalto.netfos]

Thanks for your reply.

Joy

[mikand]

As a sidenote...

If you have a new app which might be usful for others you can request app enhancement from the Apps and Threats Research Center.

http://www.paloaltonetworks.com/researchcenter/tools/

From there you can click on Submit an app and provide details there.

Those apps will be able to use URL, threat and AV engines (since they will be included in the appdb).

On the other hand I think that at least the threatdb should be able to apply even for unknown traffic (since I interpret threatdb as the IDP function of PAN) - could someone from PA perhaps put some light on why not at least the threat enginge can operate on custom apps?

[grenierm]

Has anyone tested this with custom HTTP based applications for QOS? We have bandwidth concerns during certain major events involving streaming video, ie the Olympics or US Open. I am going to guess these will be identified as web-browsing and QOS policy will not be enforced for the custom application?

[mikand]

I dunno if my previous interpretation was correct.

When you setup custom app (no matter if you use parentapp or not) you have checkboxes for if this particular app should be scanned for antivirus and the other stuff.

[grenierm]

I'm not sure I follow you Mikand. I can tell you from testing that if your custom application is HTTP based, you cannot set policy based on the app.The checkboxes for scanning have no impact.  It gets tagged as web-browsing and the rule you create is ignored which is why I have posed the question regarding QOS.

Update**

It looks like the traffic I was initially using for this testing didn't generate enough packets to function properly. We have since done some testing with an application that generates more traffic and achieved the expected results.