Status of a given threat signature?

[JimMcGrady]

I'm running a 9.1 firewall with threat protection and wildfire. How do i check that a specific threat signature is turned on and blocking?

[PavelK]

Thank you for posting question @JimMcGrady 

If signature is getting hit, you can check it in the Threat Log under: Monitor > Logs > Threat. You can narrow down to specific signature by this filter: ( threatid eq <signature ID>).

In order to check signature itself from Firewall navigate to: Objects > Security Profiles > AntiSpyware > [Profile Name] > Exceptions (Click: "Show All signatures"). You can filter the output to specific signature: ( id eq 'Sugnature ID' ). From here you can see default signature action under: "Action". If there is a rule that is overriding default signature action, you will see it under: "Rule".

You can use the same way to check Vulnerability Signatures.

Kind Regards

Pavel