Anti-virus signature not found

[Scott_Paisley]

We have logs indicating an anti-virus signature detected something, but didn't prevent it.

I want to change the action to drop, but I can't find the signature

What am I doing wrong?

[Timothy_Hall]

Need to see the full log card for this log entry with IP addresses redacted.

[Scott_Paisley]

attached

[Timothy_Hall]

Please fully expose (with redaction as needed) all areas of the log card that have a caret "^" pointing downwards.  Can't even tell if it is Anti-bot or Anti-virus with that screenshot.

[Scott_Paisley]

anti-virus

[G_W_Albrecht]

I would suggest to change all detect to prevent - its the same resources spent but no action taken (except a log) with detect.

But better contact TAC about this...

[Scott_Paisley]

that's what I want to do, but I can't find the protection to make that change

[Timothy_Hall · Accepted solution]

Was starting to suspect this was a cloud-based detection of something new for which no signature had been propagated yet, but as it turns out you can't find it in the SmartConsole now because it has been removed in an update, from the ThreatWiki: 

 

[Scott_Paisley]

OK, thanks