Ensure a secure Vulnerability Protection Profile is applied to all security rules allowing traffic

HighLevel 1Manual reviewpaloalto

Description

For any security rule allowing traffic, apply a securely configured Vulnerability Protection Profile. Careful analysis of the target environment should be performed before implementing this configuration, as outlined by PAN's "Threat Prevention Deployment Tech Note" in the references section.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Navigate to Policies > Security. For each Policy, under the Actions tab, select Vulnerability Protection. Verify either the 'Strict' or the 'Default' profile is selected, or a custom profile that complies with the organization's policies, legal and regulatory requirements.

How it is fixed

Fix method: Guidance or infrastructure patch

Navigate to Policies > Security. For each Policy, under the Actions tab, select Vulnerability Protection. Set it to use either the 'Strict' or the 'Default' profile, or a custom profile that complies with the organization's policies, legal and regulatory requirements.

Properties

Operating systems: Any
Tags: paloaltothreat-prevention
Reference: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 6.7 Ensure a secure Vulnerability Protection Profile is applied to all security rules allowing traffic