Difference between apps and contents

[tommyluke]

Dear PAN community,

When a new 'Applications and Threats' signature is release there are typically two versions that have the same Version name (e.g. 350-1658) but then differ in the File Name and Features description.

As a current example, Applications and Threats Version 350-1658 was released on 2013/01/15 and there are two of them, one with File Name panupv2-all-apps-350-1658 and the other with File Name panupv2-all-contents-350-1658. The former is 16MB and the Feature column says 'apps', the latter is 17MB and the Feature column says 'contents'.

I'd like to fully understand the purpose of each, apparently unique, release.

Thank you in advance.

Best,

tommyluke

[mbutt · Accepted solution]

Hi Tommyluke,

As per my understanding

panupv2-all-apps-350-1658 cover any new apps or modification to the apps signature and decoders.

Where as panupv2-all-contents-350-1658 covers new/modified spyware, vulnerability signatures.

Hopefully this explains the difference between the two.

Thank you

Numan

[tommyluke]

Thank you Numan, that is helpful. Do you have a source (perhaps I missed this topic in some PAN documentation?) for your understanding? That makes sense and I imagine you're correct; I'm looking for something in black & white to confirm, if possible.

I sure do appreciate the helpful response, thank you.

[sspringer]

To add to Numan's comment:

By default the firewall will come with the access to the application package: panupv2-all-apps-350-1658

However, the Threat Prevention license is required to install the content package: panupv2-all-contents-350-165

The content package contains the same information in the application package + anti-spyware and vulnerability protection signatures.

-Stefan

[mbutt]

Hi Tommyluke,

I currently do not have a document on this but i believe if you request this from your sales Engineer he might be able to provide you with that.

Thank you

Numan

[jmatanane]

Do you know if the threat prevention needs to only be on Panorama to send it out or each individual firewall, or both? Thanks!