Anti-Spyware Profiles:

o Anti-Spyware Profiles help to control spyware, contains own ruleset.

o Anti-Spyware Profile contains its own ruleset to detect & process threats.
o There are already two included predefined read only profiles default & strict.
o These can be cloned for making custom, or new profile can be built from scratch.
o Default action will be applied to traffic, generally used for the initial deployments.
o Strict implementation of the profiles used for the ‘out of the box’ protection.
o Best Practice is to create to network design, deployment & company security policy.
o Each profile can contain several rules to apply policy based on severity or type of spyware.

To create custom Anti-Spyware Profiles, select Objects> Security Profiles> Antivirus Add new
profile or can used already two created default predefined profiles (Default & Strict).

1 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

 Action Description
Default Defined by Palo Alto Networks. Typically, the default action is an alert or a
reset-both. The default action is displayed in parenthesis ().
Allow Permits the application traffic.
Alert Generates an alert for each application traffic flow. Show in threat log.
Drop Drops the application traffic.
Reset Client For TCP, resets the client-side connection. For UDP, drops the connection.
Reset Server For TCP, resets the server-side connection. For UDP, drops the connection.
Reset Both For TCP, resets connection on both client & server ends. For UDP, drops.
Block IP This action blocks traffic from either a source or a source-destination pair. It
is configurable for a specified period of time.

2 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

Apply Anti-Spyware Profile to Security Profile Rule (Inside-to-Outside).

Commit the Changes by Clicking Commit on top right corner to save the configuration.

3 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717