Question 376 - PCNSE discussion

When dealing with a false positive, particularly for a spyware threat detected through DNS queries (as indicated by the category 'dns-c2'), the correct course of action involves creating an exception in the Anti-Spyware profile, not the Vulnerability Protection profile. This is because the Anti-Spyware profile in Palo Alto Networks firewalls is designed to detect and block spyware threats, which can include command and control (C2) activities often signaled by DNS queries.

The steps to configure an exception for this specific spyware signature (threat ID: 1000011111) are as follows:

Navigate to Objects > Security Profiles > Anti-Spyware. This is where all the Anti-Spyware profiles are listed.

Select the related Anti-Spyware profile that is currently applied to the security policy which is generating the false positive.

Within the profile, go to the DNS Exceptions tab. This tab allows you to specify exceptions based on DNS signatures.

Search for the related threat ID (in this case, 1000011111) and click enable to create an exception for it. By doing this, you instruct the firewall to bypass the detection for this specific signature, effectively treating it as a false positive.

Commit the changes to make the exception active.

By following these steps, the administrator can effectively address the false positive without disabling the overall spyware protection capabilities of the firewall.