- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
10-10-2023 01:57 PM
Guys, I saw that there is a different number sometimes in the same signature. What would that be? what is it for? Is there any documentation talking about it?
If I block the subscription with a number and another one appears with another number, do I have to do this blocking too or do these numbers not interfere with the subscription blocking and just put the name?
example:
1- DESCRIPTION AndroxGh0st Scanning Traffic Detection(86759)
2- DESCRIPTION AndroxGh0st Scanning Traffic Detection(86760)
If you can help me with these questions, please!
Thank you for your attention!
10-10-2023 08:32 PM
These numbers represent the version number of the signature. In this case, "DESCRIPTION AndroxGh0st Scanning Traffic Detection(86760)" is the later version of the signature. You don't need to manually block each version as the latest threat updates include the most recent signatures.
10-10-2023 08:32 PM
These numbers represent the version number of the signature. In this case, "DESCRIPTION AndroxGh0st Scanning Traffic Detection(86760)" is the later version of the signature. You don't need to manually block each version as the latest threat updates include the most recent signatures.
10-11-2023 06:01 AM
Thanks a lot for the help!
10-16-2023 06:14 PM
Those are Unique Threat IDs.
https://threatvault.paloaltonetworks.com/?query=86759&type=
https://threatvault.paloaltonetworks.com/?query=86760&type=
Sometimes, multiple PoCs (Proof of Concept) exist for a particular vulnerability.
In other words, there are multiple ways to detect the threat. So, it's normal to see more than one signatures for the same vulnerability.
Even if the Threat name is the same, the detection logics are different.
The Security Profile is basically configured to block threats based on the Severity (not the ID).
Please refer to the Security Policy Best Practice.
https://docs.paloaltonetworks.com/best-practices/security-policy-best-practices/security-policy-best...
The ID can be used when you want to set an exception.
- How to Use Anti-Spyware, Vulnerability and Antivirus Exceptions to Block or Allow Threats
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcrCAC
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!