I want to block PotatoVPN ( Threat ID 86751 )

Showing results for 
Show  only  | Search instead for 
Did you mean: 

I want to block PotatoVPN ( Threat ID 86751 )

L0 Member


I want to be able to block PotatoVPN Traffic. I am successful in most of my other VPN threat hunting safaris but this one is fairly new and my current rules don't capture this little guy.  Has someone out there created a policy that successfully blocks potatovpn. 


Can I create a policy rule simply off of the identified threatID of potatovpn which Paloalto logs properly?  I have never done this before. PotatoVPN is not in the Applicpedia database to choose it by appid




L5 Sessionator

You can override the default action of signatures in the anti-spyware profile from, in this case, "alert" to whatever youd like. Does this address what you need? 


Edit adding more specifics: You can go to the signature exceptions tab of an anti-spyware profile, then select the show all signatures check box in the bottom left, find the signature you are looking for and change the action to what you would like, and make sure to select the enable check box on the signature itself for any signatures you edit. Then apply this anti-spyware profile to the rules you'd like, either directly or through a security profile. This is also all under the assumption you have a threat protection license.




  • 1 replies
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!