View Frontier Virtual Patching Logs

Table of Contents

View Frontier Virtual Patching Logs

Filter and review threat log entries generated by Frontier Virtual Patching predisclosure detections.

Where Can I Use This?	What Do I Need?
NGFW (Managed by Strata Cloud Manager) NGFW (Managed by PAN-OS or Panorama)	Advanced Threat Prevention Plus license

Frontier Virtual Patching detections generate entries in the threat log with the sub-type "vulnerability." To isolate Frontier Virtual Patching detections from standard detections, you can filter on the following characteristics:

Signature name—All Frontier Virtual Patching signatures use the threat name "Pre-Disclosure Vulnerability Exploit." You can filter on this exact string to isolate FVP detections from standard detections.
Threat ID—Filter by a specific Threat ID to view all detections for a single predisclosure signature.
Cloud Report ID—On PAN-OS, Frontier Virtual Patching detections include a Cloud Report ID. Standard vulnerability detections do not have a Cloud Report ID, so this field can help distinguish FVP detections from standard detections.
CVE—Predisclosure signatures show "Unassigned" in the CVE field until the vulnerability is publicly disclosed.

Each Frontier Virtual Patching threat log entry includes the following fields:

Threat Name—All Frontier Virtual Patching signatures use the name "Pre-Disclosure Vulnerability Exploit."
Threat ID—The unique, permanent identifier for the signature. The same Threat ID is associated with the corresponding CVE-based signature after disclosure.
Subtype—"vulnerability" — the same sub-type used by standard vulnerability protection signatures.
Threat Category—Code-Execution for all predisclosure signatures.
Severity—Critical, High, or Medium.
Action—The action taken by the firewall (for example, alert, block, reset-both, reset-client, reset-server).
Direction—Whether the threat was assessed from client-to-server, server-to-client, or both.
Source/Destination IP—The initiator and target of the session.
Source/Destination Zone—The zones the traffic traversed.
Application—The application layer protocol identified by App-ID.
Rule Name—The security policy rule that matched the traffic.
Cloud Report ID—A unique identifier for the cloud analysis report associated with the detection. On PAN-OS, you can retrieve the full report using this ID through the Threat Vault API. The report includes session information, detection service results, and MITRE ATT&CK® classified techniques.

Fields not listed here are the same as for existing vulnerability event logs. FVP supports log exportability and Strata™ Logging Service logging.

Only malicious verdicts from the Frontier Virtual Patching cloud are logged. Benign verdicts are not logged. Sessions that the pre-filter screens out without forwarding to the cloud generate no log entries.

PAN-OS & Panorama

View and filter Frontier Virtual Patching threat log entries on PAN-OS or Panorama.

Frontier Virtual Patching detections appear in the threat log alongside standard vulnerability protection detections. Use the log filter to isolate predisclosure detections.

Select MonitorLogsThreat.
In the filter bar, add a filter to isolate Frontier Virtual Patching detections.

Filter by Threat ID to view detections for a specific Frontier Virtual Patching signature, or filter by threat name (for example, (name-of-threatid eq 'Pre-Disclosure Vulnerability Exploit')). You can also identify Frontier Virtual Patching detections by the Cloud Report ID column — FVP detections include a Cloud Report ID, while standard vulnerability detections do not.
Select a log entry to view the detection details.
The detail view displays the threat name, Threat ID, threat category, severity, action taken, direction, source and destination addresses and zones, the matched security policy rule, and the Cloud Report ID. To retrieve the full cloud report, use the Cloud Report ID with the Threat Vault API.
(Optional) In the threat log list, click the Exception popup next to a threat entry to open the Threat Details dialog.

For predisclosure signatures, the Threat Details dialog shows the Threat ID and severity. The Name field displays "Unknown" and the CVE, Vendor ID, and Reference fields are blank because the vulnerability details are not yet publicly disclosed.

The bottom panel lists the Exempt Profiles that have an exception configured for this signature and indicates which profiles are used in the current security rule. You can also create an exception directly from this dialog.

Strata Cloud Manager

View and filter Frontier Virtual Patching threat log entries in Strata Cloud Manager.

In Strata Cloud Manager, you can view Frontier Virtual Patching detections in the Log Viewer by filtering for the Threat ID or threat name. You can also access threat logs directly from the Activity Insights drill-down using the View Log link.

Select Incidents & AlertsLog Viewer.
For Log Type, choose Network/Threat.
In the filter bar, add a filter to isolate Frontier Virtual Patching detections.

Filter by Threat Name Firewall = Pre-Disclosure Vulnerability Exploit to show all Frontier Virtual Patching detections. You can also filter by a specific Threat ID to view detections for a single predisclosure signature.
Select a log entry to view the detection details.
The detail view displays the threat name, Threat ID, threat category, severity, action taken, direction, source and destination addresses and zones, and the matched security policy rule. You can also click Log Details for the full log entry.

Advanced Threat Prevention

View Frontier Virtual Patching Logs

Advanced Threat Prevention

View Frontier Virtual Patching Logs

PAN-OS & Panorama

Strata Cloud Manager

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Network Security

Endpoints

Visibility & Monitoring

Best Practices