PAN-OS & Panorama

Exclude antivirus signatures from enforcement.
While you can use an Antivirus profile to exclude antivirus signatures from enforcement, you cannot change the action the firewall enforces for a specific antivirus signature. However, you can define the action for the firewall to enforce for viruses found in different types of traffic by editing the Decoders (
Objects
Security Profiles
Antivirus
> <antivirus-profile> > Antivirus
).
Select
Objects
Security Profiles
Antivirus
.
Add
or modify an existing Antivirus profile from which you want to exclude a threat signature and select
Signature Exceptions
.
Add
the
Threat ID
for the threat signature you want to exclude from enforcement.

Click
OK
to save the Antivirus profile.
Modify enforcement for vulnerability and spyware signatures (except DNS signatures; skip to the next option to modify enforcement for DNS signatures, which are a type of spyware signature).
Select
Objects
Security Profiles
Anti-Spyware
or
Objects
Security Profiles
Vulnerability Protection
.
Add
or modify an existing Anti-Spyware or Vulnerability Protection profile from which you want to exclude the threat signature and then select either
Signature Exceptions
for Anti-Spyware Protection profiles or
Exceptions
for Vulnerability Protection profiles.
Show all signatures
and then filter to select the signature for which you want to modify enforcement rules.
Check the box under the
Enable
column for the signature whose enforcement you want to modify.
Select the
Action
you want the firewall to enforce for this threat signature.

For signatures that you want to exclude from enforcement because they trigger false positives, set the
Action
to
Allow
.
Click
OK
to save your new or modified Anti-Spyware or Vulnerability Protection profile.
Modify enforcement for DNS signatures.
By default, the DNS lookups to malicious hostnames that DNS signatures are detect are sinkholed.
Select
Objects
Security Profiles
Anti-Spyware
.
Add
or modify the Anti-Spyware profile from which you want to exclude the threat signature, and select
DNS Exceptions
.
Search for the DNS Threat ID for the DNS signature that you want to exclude from enforcement and select the box of the applicable signature:

Click
OK
to save your new or modified Anti-Spyware profile.