TMA-PALOALTO-6.1

Ensure that antivirus profiles are set to reset-both on all decoders except 'imap' and 'pop3'

높음레벨 1자동paloalto

설명

Configure antivirus profiles to a value of 'reset-both' for all decoders except imap and pop3 under both Action and WildFire Action. If required by the organization's email implementation, configure imap and pop3 decoders to 'alert' under both Action and WildFire Action. FAILs if any antivirus profile sets action or wildfire-action on the ftp, http, http2, smb or smtp decoder to anything other than reset-both (imap/pop3 may use alert). Audited against the PAN-OS running configuration in set format: run 'set cli config-output-format set', then 'configure' and 'show' (or 'show config running') and save the full output.

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles virus (?:"[^"\n]*"|\S+) decoder (?:ftp|http|http2|smb|smtp) (?:action|wildfire-action) (?:default|allow|alert|drop|reset-client|reset-server)[ \t]*$

조치 방법

조치 방식: 가이드 또는 인프라 패치

configure set profiles virus <profile> decoder http action reset-both set profiles virus <profile> decoder http wildfire-action reset-both (repeat for ftp, http2, smb, smtp) commit # CIS guidance: Navigate to Objects > Security Profiles > Antivirus. Set antivirus profiles to have all decoders set to reset-both for both Action and Wildfire Action. If imap and pop3 are required in the organization, set the imap and pop3 decoders to alert for both Action and Wildfire Action.

속성

운영 체제: 모두
태그: paloaltothreat-prevention
참고 자료: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 6.1 Ensure that antivirus profiles are set to reset-both on all decoders except 'imap' and 'pop3'

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target paloalto