Frontier Virtual Patching Exceptions

Table of Contents

Frontier Virtual Patching Exceptions

Manage exceptions for Frontier Virtual Patching signatures to exclude specific traffic or change the action for individual Threat IDs.

Where Can I Use This?	What Do I Need?
NGFW (Managed by Strata Cloud Manager) NGFW (Managed by PAN-OS or Panorama)	Advanced Threat Prevention Plus license

You manage Frontier Virtual Patching exceptions through the same mechanisms used for standard Vulnerability Protection exceptions. Exceptions allow you to exclude specific signatures from enforcement, change the action for individual Threat IDs, or exclude specific traffic from Frontier Virtual Patching inspection. On PAN-OS and Panorama, the Exceptions tab provides separate views for Released Signatures and Frontier Virtual Patching Signatures. In Strata Cloud Manager, Frontier Virtual Patching exceptions are called overrides.

Exception Persistence Across Signature Migration

Because Frontier Virtual Patching Threat IDs persist when a signature moves from the cloud to a standard content update, any exception you create for a predisclosure signature remains effective after the move. You do not need to recreate exceptions when signatures transition from cloud-based to content-based detection.

Logging and Monitoring

Frontier Virtual Patching detections generate entries in the threat log with the sub-type "vulnerability." Each entry includes the threat name, Threat ID, threat category, severity, action taken, direction, source and destination addresses, and the matched security policy rule. All other fields are consistent with existing threat event logs.

Only detections (malicious verdicts) are logged. Benign verdicts from cloud inspection are not logged. Sessions that the pre-filter screens out without being forwarded to the cloud generate no log entries.

PAN-OS & Panorama

Manage Frontier Virtual Patching signature exceptions in the Vulnerability Protection profile on PAN-OS or Panorama.

The Exceptions tab of the Vulnerability Protection profile provides two views: Released Signatures for standard content-based signatures and Frontier Virtual Patching Signatures for cloud-based predisclosure signatures. You can change the action for individual signatures in either view.

Select ObjectsSecurity ProfilesVulnerability Protection and open the profile you want to modify.
Select the Exceptions tab.
Select Frontier Virtual Patching Signatures to switch to the predisclosure signature view.
Each entry displays the following columns:
- Enable—Select to enable an exception for this signature.
- ID—The unique Threat ID for the signature.
- Threat Name—The signature name (generic predisclosure format while under embargo; full descriptive name after disclosure).
- Host—Whether the detection applies to Client or Server sessions.
- Category—Code-Execution (all predisclosure signatures use this category).
- Severity—Critical, High, or Medium.
- Action—The current action for this signature (for example, "default (alert)").
Select the checkbox next to a signature to modify its exception settings.
For Action, choose the action to override the severity-level default.
Click OK to save the profile.
Enable Show all signatures to list all Frontier Virtual Patching signatures. When disabled, only signatures with configured exceptions are listed. Use PDF/CSV to export the signature list.
Commit your changes.

Strata Cloud Manager

Manage Frontier Virtual Patching overrides in the Vulnerability Protection profile in Strata Cloud Manager.

In Strata Cloud Manager, Frontier Virtual Patching signature-level exceptions are called overrides. You can exclude a signature from enforcement or change the signature action, and optionally limit the override to apply only when a specific IP address is the source or destination for a session.

Select ConfigurationNGFW and Prisma AccessSecurity ServicesVulnerability Protection and open the profile you want to modify.
In the Overrides panel, click Add Override.
The overrides table displays the following columns:
- Threat ID—The unique identifier for the signature.
- Threat Name—The signature name (generic predisclosure format while under embargo).
- CVE—"Unassigned" for predisclosure signatures.
- Host Type—Whether the override applies to Client or Server detections.
- Severity—Critical, High, or Medium.
- Category—The attack category.
- Applied to IP Address—An optional IP address restriction. When set, the override applies only when this IP address is the source or destination for the session.
- Last Triggered—The date the override was last matched against traffic.
Configure the override settings for the signature.
The Add Override dialog allows you to filter and select signatures using the following criteria:
- Match Criteria—Filter by Severity, Category, and Host Type (any, client, or server).
- Search—Search by Threat Name, Threat ID, CVE, or Vendor Reference ID to find specific signatures.
The Matching Signatures table displays signatures that match your filter criteria, showing the Threat Name, Threat ID, Category, Vendor Reference ID, CVE, Host Type, Severity, and Default Action.

To find Frontier Virtual Patching signatures, enter Pre-Disclosure Vulnerability Exploit in the Matching Signatures search bar. The table filters to show only predisclosure signatures. Identify the signature you want to override by its Threat ID, then select it and configure the override:
- Action—Choose the action to override the default for this signature.
- Packet Capture—Enable or disable packet capture for the override.
- Apply to IP Addresses—Optionally restrict the override to specific IP addresses.
- Apply to Vulnerability Protection Profiles—Select which profiles the override applies to.
Click Save to save the profile.
Push your changes to the managed firewalls.