Manage Custom or Unknown Applications

Incomplete data—A handshake took place, but no data packets were sent prior to the timeout.
Insufficient data—A handshake took place followed by one or more data packets; however, not enough data packets were exchanged to identify the application.

Create security policies to control unknown applications by unknown TCP, unknown UDP or by a combination of source zone, destination zone, and IP addresses.
Request an App-ID from Palo Alto Networks—If you would like to inspect and control the applications that traverse your network, for any unknown traffic, you can record a packet capture. If the packet capture reveals that the application is a commercial application, you can submit this packet capture to Palo Alto Networks for App-ID development. If it is an internal application, you can create a custom App-ID and/or define an application override policy.
Create a Custom Application with a signature and attach it to a security policy, or create a custom application and define a custom timeout. Avoid creating Application Override policies because they bypass layer 7 application processing and threat inspection, and use less secure stateful layer 4 inspection instead. Instead, use custom timeouts so that you can control and inspect the application traffic at layer 7.
A custom application allows you to customize the definition of the internal application—its characteristics, category and sub-category, risk, port, and timeout—and to exercise granular policy control and help eliminate unidentified traffic on your network. Creating a custom application also allows you to correctly identify the application in the
ACC
and traffic logs, and is useful in auditing/reporting on the applications on your network. To create a custom application, specify a signature and a pattern that uniquely identifies the application and attach it to a Security policy rule that allows or denies the application.
For example, if you build a custom application that triggers on a host header www.mywebsite.com, the packets are first identified as web-browsing and then are matched as your custom application (whose parent application is web-browsing). Because the parent application is web-browsing, the custom application is inspected at Layer-7 and scanned for content and vulnerabilities.