TMA-PALOALTO-5.8
Ensure that 'Inline Cloud Analysis' on Wildfire profiles is enabled
설명
Enable 'Advanced WildFire Inline Cloud Analysis' on Wildfire profiles and forward PE files for analysis. Palo Alto Networks Advanced WildFire operates a series of cloud- based ML detection engines that provide inline analysis of PE (portable executable) files traversing your network to detect and prevent advanced malware in real-time.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
Navigate to Objects > Security Profiles > Wildfire Verify that Wildfire profiles has Enable cloud inline analysis checked. On Inline cloud analysis tab, verify that there is a rule to forward files with the following settings: Application set to Any File Type set to PE Direction set to Both Action set to Block
조치 방법
조치 방식: 가이드 또는 인프라 패치
Navigate to Objects > Security Profiles > Wildfire On relevant Wildfire profile, checked Enable cloud inline analysis box. On Inline cloud analysis tab, configure a rule to forward files with the following settings: Application set to Any File Type set to PE Direction set to Both Action set to Block
속성
- 운영 체제
- 모두
- 태그
- paloaltothreat-prevention
- 참고 자료
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 5.8 Ensure that 'Inline Cloud Analysis' on Wildfire profiles is enabled