Threat Details

Reply
Highlighted
L4 Transporter

Threat Details

Hused in current.png

 

Hi,

What is Exempt profile here , 

Since severity is informational , Do we need to  care about this ? 

What if we don't want  alert  or any action  if the severity is informational ? 

 

anti spyware profile.png

 

Is it good practice just one rule in an antispyware profile ?

 

Thanks


Accepted Solutions
L7 Applicator

Re: Threat Details

ok, sorry for the confusion!  let's start from the beginning :)

 

in the LOG view, you can open the threat details. you can add exceptions in here based on the IP address or the profile

exempt profiles.png

 

this view simply allows you to add an exception for the IP involved or the whole profile, so you don't need to go into the objects tab, find the profile, go to the exceptions tab, try to remember the threat ID and then add an exception.

 

vulnerability profile.png

 

I hope i made it more clear :)

reaper - PANgurus.com
I drink and I know things

View solution in original post


All Replies
Highlighted
L7 Applicator

Re: Threat Details

Hi @sib2017

 

The exempt profile means that someone made an exception for this threat to NOT be monitored by the profile in the list

so any security policy where this profile is used will not hit on this threat

 

If the profile is used in internal policy or if the threat i 'to be expected' due to how your TLS infrastructure is set up, it may not be sonething to worry about... best is to figure out who set it and why :)

 

I would recommend to have at least a few rules in the AntiSpyware (and AV and threat) profiles to take different approaches to each severity

i usually have all kinds of bells and whistles (block-ip, extended packetcapture) for critical and high, less bells for medium and low, and simply alerting for informational , i touch on this in this video :) Tutorial: Configuring Your Security Policy

reaper - PANgurus.com
I drink and I know things
Highlighted
L4 Transporter

Re: Threat Details

Hi,

Thanks reaper .You mean this threat was never monitored by the spyware profile which is used in my security rules 1 ...10 (for example),
So how can I add or delete from this exempted list ?
If this threat was exempted in this profile , how the PA did an action (reset-both) in the list as below

 

pa-suspicious.png
Thanks

Highlighted
L7 Applicator

Re: Threat Details

ah wait, i made a booboo

that first screenshot you showed is the log info, not the profile info of that threat

 

in the LOG detail view you can check that box next to the profile to add an exception for that threat to that profile

to take it out you need to go into the profile and remove the threatID from the exceptions tab

 

but uhm... your action is set to alert in the profile while the policy is reset both, is this the same profile ?

if you have a profile with only 1 rule set to alert, nothing should be blocked 

 

 

reaper - PANgurus.com
I drink and I know things
Highlighted
L4 Transporter

Re: Threat Details

Hi,

Sorry I am little confused . 

"in the LOG detail view you can check that box next to the profile to add an exception for that threat ".

 

 if you are talking aboot the first pic in my post , I can add only ip address   .

That means i can exempt only ip address there ?

 

So in my case It was not exempted .

 

 

"your action is set to alert in the profile while the policy is reset both, is this the same profile ?

if you have a profile with only 1 rule set to alert, nothing should be blocked " 

 

No ,it was " reset-both ", Then i Changed to  alert   

 

Thanks

 

 

 

L7 Applicator

Re: Threat Details

ok, sorry for the confusion!  let's start from the beginning :)

 

in the LOG view, you can open the threat details. you can add exceptions in here based on the IP address or the profile

exempt profiles.png

 

this view simply allows you to add an exception for the IP involved or the whole profile, so you don't need to go into the objects tab, find the profile, go to the exceptions tab, try to remember the threat ID and then add an exception.

 

vulnerability profile.png

 

I hope i made it more clear :)

reaper - PANgurus.com
I drink and I know things

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!