Ensure an anti-spyware profile is configured to block on specified spyware severity levels, categories, and threats

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón

(?m)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles spyware (?:"[^"\n]*"|\S+) rules (?:"[^"\n]*"|\S+) action reset-both[ \t]*$

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

configure set profiles spyware <profile> rules block-crit-high-med severity [ critical high medium ] set profiles spyware <profile> rules block-crit-high-med category any set profiles spyware <profile> rules block-crit-high-med threat-name any set profiles spyware <profile> rules block-crit-high-med action reset-both commit # CIS guidance: Navigate to Objects > Security Profiles > Anti-Spyware. Click on existing profile in used or create a new profile. Navigate to Signature Policies tab. Add new policy by giving it a name Policy Name. Set a Policy Name exists within the anti-spyware profile that is configured to perform the reset-both on Critical, High, and Medium Severity level, any Category, and any Threat Name.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target paloalto