Signature Policy in Anti Spyware Profile

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Signature Policy in Anti Spyware Profile

L1 Bithead

What does Signature policy in Anti Spyware do, and what  does "Default" in Action do.

2 REPLIES 2

Cyber Elite
Cyber Elite

Thank you for posting question @rajumaharjan

 

The Anti-Spyware policy called: "default" comes automatically after you install Threat Prevention license and install the Application and Threat package. Not licensed Firewalls have this profile as well, however there is a message: "Threat Prevention License required for antivirus, anti-spyware, and vulnerability protection to function". The action default simply means that it will take default action based on signature. For example if signature has default action: (reset-both) it will send TCP RST to client and server. If the signature has default action: (alert) it will only make record in Threat log. You can see all the signature by going to: Exceptions and clicking on: show all signatures.

 

PavelK_0-1632809591503.png

 

If you want to get more information about signature you can go to: https://threatvault.paloaltonetworks.com/ then search for signature based on name, threat id,... From here you can see more information for example when and in what Threat package it was released.

 

Note: Unless you link the Anti-Spyware profile into: Security Profile Group and this group assign to security policy, it will not have any effect.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

L1 Bithead

Thank you for the reply, got the answer.

  • 1898 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!