What would this number be at the end of some signatures?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

What would this number be at the end of some signatures?

Guys, I saw that there is a different number sometimes in the same signature. What would that be? what is it for? Is there any documentation talking about it?
If I block the subscription with a number and another one appears with another number, do I have to do this blocking too or do these numbers not interfere with the subscription blocking and just put the name?

example:

1- DESCRIPTION AndroxGh0st Scanning Traffic Detection(86759
2- DESCRIPTION AndroxGh0st Scanning Traffic Detection(86760)

If you can help me with these questions, please!


Thank you for your attention!

1 accepted solution

Accepted Solutions

Community Team Member

Hi @filipe.r.oliveira,

 

These numbers represent the version number of the signature. In this case, "DESCRIPTION AndroxGh0st Scanning Traffic Detection(86760)" is the later version of the signature.  You don't need to manually block each version as the latest threat updates include the most recent signatures. 

LIVEcommunity team member
Stay Secure,
Jay
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

View solution in original post

3 REPLIES 3

Community Team Member

Hi @filipe.r.oliveira,

 

These numbers represent the version number of the signature. In this case, "DESCRIPTION AndroxGh0st Scanning Traffic Detection(86760)" is the later version of the signature.  You don't need to manually block each version as the latest threat updates include the most recent signatures. 

LIVEcommunity team member
Stay Secure,
Jay
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Thanks a lot for the help!

L5 Sessionator

Those are Unique Threat IDs.
https://threatvault.paloaltonetworks.com/?query=86759&type=

https://threatvault.paloaltonetworks.com/?query=86760&type=

 

Sometimes, multiple PoCs (Proof of Concept) exist for a particular vulnerability.
In other words, there are multiple ways to detect the threat. So, it's normal to see more than one signatures for the same vulnerability.
Even if the Threat name is the same, the detection logics are different.

 

The Security Profile is basically configured to block threats based on the Severity (not the ID).
Please refer to the Security Policy Best Practice.
https://docs.paloaltonetworks.com/best-practices/security-policy-best-practices/security-policy-best...

 

The ID can be used when you want to set an exception.
- How to Use Anti-Spyware, Vulnerability and Antivirus Exceptions to Block or Allow Threats
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcrCAC

 

  • 1 accepted solution
  • 1252 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!