Ensure an anti-spyware profile is configured to block on specified spyware severity levels, categories, and threats

높음레벨 1자동paloalto

설명

If a single rule exists within the anti-spyware profile, configure it to block on Critical, High, and Medium spyware severity level, any category, and any threat. If multiple rules exist within the anti-spyware profile, ensure all spyware categories, threats, and severity levels (Critical, High, and Medium) are set to be blocked. Additional rules may exist for packet capture or exclusion purposes. PASS requires an anti-spyware profile rule with action reset-both; confirm it covers severity critical, high and medium, category any and threat-name any. Audited against the PAN-OS running configuration in set format: run 'set cli config-output-format set', then 'configure' and 'show' (or 'show config running') and save the full output.

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?profiles spyware (?:"[^"\n]*"|\S+) rules (?:"[^"\n]*"|\S+) action reset-both[ \t]*$

조치 방법

조치 방식: 가이드 또는 인프라 패치

configure set profiles spyware <profile> rules block-crit-high-med severity [ critical high medium ] set profiles spyware <profile> rules block-crit-high-med category any set profiles spyware <profile> rules block-crit-high-med threat-name any set profiles spyware <profile> rules block-crit-high-med action reset-both commit # CIS guidance: Navigate to Objects > Security Profiles > Anti-Spyware. Click on existing profile in used or create a new profile. Navigate to Signature Policies tab. Add new policy by giving it a name Policy Name. Set a Policy Name exists within the anti-spyware profile that is configured to perform the reset-both on Critical, High, and Medium Severity level, any Category, and any Threat Name.

속성

운영 체제: 모두
태그: paloaltothreat-prevention
참고 자료: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 6.3 Ensure an anti-spyware profile is configured to block on specified spyware severity levels, categories, and threats

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target paloalto