PAN-OS - Block all unknown and unauthorized applications

This playbook is used to find and remove all rules that allow unauthorized applications communication as any. The playbook performs the following tasks: - Lists PAN-OS policy rules. - Checks for a rule that allows applications as any. - Deletes the rule based on user approval. - Commits the configuration.

MITRE ATT&CK - Courses of Action · 8 tasks · 3 inputs · 0 outputs

Inputs

  • pre_post — Rules location. Can be 'pre-rulebase' or 'post-rulebase'. Mandatory for Panorama instances.
  • device-group — The device group for which to return addresses (Panorama instances).
  • tag — Tag for which to filter the rules.

Commands used

pan-os-delete-rule pan-os-list-rules

Flowchart

yes yes no yes Start Start Is PAN-OS integration enabled? Is PAN-OS integration ena... Done Done PAN-OS - List rules - pan-os-list-rules PAN-OS - List rules pan-os-list-rules Is there a rule that allows application as any? Is there a rule that allo... PAN-OS - Delete rule - pan-os-delete-rule PAN-OS - Delete rule pan-os-delete-rule Delete rule? Delete rule? PAN-OS Commit Configuration - PAN-OS Commit Configuration PAN-OS Commit Configuration PAN-OS Commit Configuration