Palo Alto Networks
TMA-PALOALTO-6.3
Ensure an anti-spyware profile is configured to block on specified spyware severity levels, categories, and threats
Description
If a single rule exists within the anti-spyware profile, configure it to block on Critical, High, and Medium spyware severity level, any category, and any threat. If multiple rules exist within the anti-spyware profile, ensure all spyware categories, threats, and severity levels (Critical, High, and Medium) are set to be blocked. Additional rules may exist for packet capture or exclusion purposes. PASS requires an anti-spyware profile rule with action reset-both; confirm it covers severity critical, high and medium, category any and threat-name any. Audited against the PAN-OS running configuration in set format: run 'set cli config-output-format set', then 'configure' and 'show' (or 'show config running') and save the full output.
Méthode de vérification
Méthode d'audit: Motif de configuration
- Motif
(?m)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles spyware (?:"[^"\n]*"|\S+) rules (?:"[^"\n]*"|\S+) action reset-both[ \t]*$
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
configure set profiles spyware <profile> rules block-crit-high-med severity [ critical high medium ] set profiles spyware <profile> rules block-crit-high-med category any set profiles spyware <profile> rules block-crit-high-med threat-name any set profiles spyware <profile> rules block-crit-high-med action reset-both commit # CIS guidance: Navigate to Objects > Security Profiles > Anti-Spyware. Click on existing profile in used or create a new profile. Navigate to Signature Policies tab. Add new policy by giving it a name Policy Name. Set a Policy Name exists within the anti-spyware profile that is configured to perform the reset-both on Critical, High, and Medium Severity level, any Category, and any Threat Name.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- paloaltothreat-prevention
- Référence
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 6.3 Ensure an anti-spyware profile is configured to block on specified spyware severity levels, categories, and threats
Vérifier cet hôte
Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.
tmaegis scan --target paloalto