Configure a new default threat signature with Deny All to all severity options. Review the logs to understand the impact.

Set up a Linux VM as the frontend gateway for the application. Create iptables rules to drop all packets, excluding the application port.

For all severity options (critical, high, medium, low and informational) in the security profile, change the default override action to Deny.

Configure Cloud Scheduler to run a task that checks the Cloud NGFW logs to verify the threats. Configure the task to create a security profile with each signature ID set to override the default action.