Strata Cloud Manager

1. Select ConfigurationNGFW and Prisma AccessSecurity ServicesVulnerability Protection and open the profile you want to modify.
2. In the Overrides panel, click Add Override.

   The overrides table displays the following columns:

   • Threat ID—The unique identifier for the signature.
   • Threat Name—The signature name (generic predisclosure format while under embargo).
   • CVE—"Unassigned" for predisclosure signatures.
   • Host Type—Whether the override applies to Client or Server detections.
   • Severity—Critical, High, or Medium.
   • Category—The attack category.
   • Applied to IP Address—An optional IP address restriction. When set, the override applies only when this IP address is the source or destination for the session.
   • Last Triggered—The date the override was last matched against traffic.
3. Configure the override settings for the signature.

   The Add Override dialog allows you to filter and select signatures using the following criteria:

   • Match Criteria—Filter by Severity, Category, and Host Type (any, client, or server).
   • Search—Search by Threat Name, Threat ID, CVE, or Vendor Reference ID to find specific signatures.

   The Matching Signatures table displays signatures that match your filter criteria, showing the Threat Name, Threat ID, Category, Vendor Reference ID, CVE, Host Type, Severity, and Default Action.

   To find Frontier Virtual Patching signatures, enter Pre-Disclosure Vulnerability Exploit in the Matching Signatures search bar. The table filters to show only predisclosure signatures. Identify the signature you want to override by its Threat ID, then select it and configure the override:

   • Action—Choose the action to override the default for this signature.
   • Packet Capture—Enable or disable packet capture for the override.
   • Apply to IP Addresses—Optionally restrict the override to specific IP addresses.
   • Apply to Vulnerability Protection Profiles—Select which profiles the override applies to.

4. Click Save to save the profile.
5. Push your changes to the managed firewalls.