View Frontier Virtual Patching Signature Details in Threat Search
Use Threat Search to look up predisclosure signature details, track protection
status, and identify when a signature has moved from predisclosure to disclosed.
| Where Can I Use
This? | What Do I Need? |
|---|
Threat Search is the primary place to view detailed metadata for Frontier Virtual
Patching signatures, including their predisclosure status and whether they have moved to
a standard content signature after public disclosure. While threat logs show the generic
name "Pre-Disclosure Vulnerability Exploit" for all predisclosure signatures, Threat
Search retrieves the signature metadata from the cloud and displays a more descriptive
name and additional context.
You can access Threat Search from
Strata Cloud Manager, from the
View in Threat Vault link in the PAN-OS Threat Details
dialog, or from the threats list in Activity Insights.
Predisclosure Signature Fields
When you look up a Frontier Virtual Patching signature in Threat Search, the
following fields are displayed:
- Name—A descriptive predisclosure name that identifies the vulnerability
type and affected software. This is more specific than the generic
"Pre-Disclosure Vulnerability Exploit" name shown in threat logs.
- Unique Threat ID—The permanent identifier for the signature.
- Description—"Under Embargo - Details withheld until coordinated
disclosure" while the signature is in predisclosure. After disclosure, this is
replaced with a full technical description of the vulnerability.
- Category—Code-Execution (all predisclosure signatures use this
category).
- PAN-OS Minimum Version—The earliest PAN-OS version that supports this
signature.
- PAN-OS Maximum Version—The latest PAN-OS version for the signature, if
applicable.
- Severity—Critical, High, or Medium.
- Action—The Palo Alto Networks recommended default action (for example,
"alert" or "reset-server"). These default actions are set by Palo Alto Networks
to ensure optimal security vs availability given the detection nature.
- Vendor ID—Blank while the signature is in predisclosure. After
disclosure, the vendor advisory identifier is populated.
- CVE—"unassigned" while the signature is in predisclosure. After
disclosure, the assigned CVE number is populated.
- Vulnerability Discovery Source—The entity that discovered the
vulnerability (for example, "Palo Alto Networks Research").
- Vulnerability Disclosure—"Not disclosed" while the signature is in
predisclosure. After disclosure, the date the vulnerability was publicly
disclosed.
- Pre-Disclosure Release—The date the signature was added to the Frontier
Virtual Patching cloud.
- First Release—"not available" while the signature is in predisclosure.
After disclosure, this shows the content release version and date when the
signature was first published in a standard content update.
- Latest Update—"not available" while the signature is in predisclosure.
After disclosure, this shows the content release version and date when the
signature was last updated.
- Reference—Blank while the signature is in predisclosure. After
disclosure, links to vendor advisories and other references are added.
- Status—"pre-disclosure" while the signature is under embargo. After
disclosure, this changes to "released."
Threat Search also displays a Protection Status indicator that shows how long
the predisclosure protection was active before the first attack was seen in your
network (for example, "30 Days Protected Before First Attack").
Evidence in Your Network
The Evidence in Your Network panel shows detection activity for the signature
in your network:
- First Seen in Your Network—The date and time the signature was first
triggered. Shows "N/A" if the signature has not been detected in your
network.
- Total, Blocked, and Alerted counts—The number of detections and how
they were handled.
- Timeline chart—A visual timeline of detection activity over the
selected time range.
- Last Seen in Your Network—The most recent detection date and time.
Use the View Log link to jump directly to the relevant threat
log entries for this signature.
Identifying Disclosed Signatures
When a predisclosure signature moves to a standard content update after public
vulnerability disclosure, the Threat ID remains the same but the metadata is
updated. To determine whether a signature has been disclosed, look for these
changes in Threat Search:
- The Status changes from "pre-disclosure" to "released."
- The Name changes from the predisclosure format to the actual
vulnerability name.
- The Description is replaced with a full technical description.
- The CVE, Vendor ID, and Reference fields are
populated.
- The First Release and Latest Update fields show the content
release version and date.
Any exceptions you configured for the signature during the predisclosure period
remain in effect after disclosure. You do not need to recreate exceptions when a
signature transitions from cloud-based to content-based detection.
