More granular with Vulnerability Exceptions?

cancel
Showing results for 
Search instead for 
Did you mean: 

More granular with Vulnerability Exceptions?

L4 Transporter

When adding a Vulnerability Exception, is there any way to make the exception more granular? (being able to add the exception along with an IP host or range, source or destination IP, zones, or virtual systems.)  For example, If I wanted to ignore a certain vulnerability that is causing false positives and is coming from the inside of the network, I would have to add that vulnerability to the exceptions list.  But by adding it to the list, I am also ignoring that vulnerability completely.  I would like Palo Alto to still be able to monitor for that vulnerability, just not within certain parameters.

3 REPLIES 3

L4 Transporter

Hello Jambulo,

the only way to do this is to create another vulnerability profile, add the desired exception, then create another policy that details your desired granularity (source ip, destination ip, etc..) and add that new vulnerability profile to it.

thanks,

Stephen

Hi,

we would appreciate if you could consider this as a feature request or something to add in the future.

Every IPS solution has this possibility and granularity and we'd like to see it in PAN also.

It would be useful if the exception could be activated also by right-clicking on the interested log entry (as many vendor does)...

Thanks

swhyte wrote:

Hello Jambulo,

the only way to do this is to create another vulnerability profile, add the desired exception, then create another policy that details your desired granularity (source ip, destination ip, etc..) and add that new vulnerability profile to it.

thanks,

Stephen

Thanks for the tip...I tried it and it works, but have 2 concerns...

1) When I create a new policy that includes a specific IP address and the new vulnerability profile, it does work correctly at ignoring the vulnerability.  BUT, ANYTHING that comes through with the IP address stated in the new policy, gets labeled as using the "rule" for that new policy.  It looks like the policies are using a Bolean OR operator, when it should be using AND.

2) If I had to create multiple policies for multiple exceptions, would it create a lot of exta load? Since it scans through all the vulnerabilities minus the exception in Policy 1, then scans through all the vulnerabilities minus the exception in Policy 2, and so on...(I have Packet Capture on too)

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!