PAN-OS - Block all unknown and unauthorized applications

This playbook is used to find and remove all rules that allow unauthorized applications communication as any. The playbook performs the following tasks: - Lists PAN-OS policy rules. - Checks for a rule that allows applications as any. - Deletes the rule based on user approval. - Commits the configuration.

MITRE ATT&CK - Courses of Action · 8 tasks · 3 inputs · 0 outputs

Details

ID	`PAN-OS - Block all unknown and unauthorized applications`
From Version	6.5.0
Tasks	8

README

This playbook is used to find and remove all rules that allow unauthorized applications communication as any.
The playbook performs the following tasks:

Lists PAN-OS policy rules.
Checks for a rule that allows applications as any.
Deletes the rule based on user approval.
Commits the configuration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

PAN-OS Commit Configuration

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

pan-os-list-rules
pan-os-delete-rule

Playbook Inputs

Name	Description	Required
pre_post	Rules location. Can be ‘pre-rulebase’ or ‘post-rulebase’. Mandatory for Panorama instances.	Optional
device-group	The device group for which to return addresses (Panorama instances).	Optional
tag	Tag for which to filter the rules.	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

PAN-OS - Block all unknown and unauthorized applications

Inputs

pre_post — Rules location. Can be 'pre-rulebase' or 'post-rulebase'. Mandatory for Panorama instances.
device-group — The device group for which to return addresses (Panorama instances).
tag — Tag for which to filter the rules.

Commands used

pan-os-delete-rule pan-os-list-rules

Flowchart

Source

playbook-PAN-OS_-_Block_all_unknown_and_unauthorized_applications.yml

Download History Raw

description: |
  This playbook is used to find and remove all rules that allow unauthorized applications communication as any.
  The playbook performs the following tasks:
  - Lists PAN-OS policy rules.
  - Checks for a rule that allows applications as any.
  - Deletes the rule based on user approval.
  - Commits the configuration.
id: PAN-OS - Block all unknown and unauthorized applications
inputs:
- description: Rules location. Can be 'pre-rulebase' or 'post-rulebase'. Mandatory for Panorama instances.
  key: pre_post
  playbookInputQuery:
  required: false
  value: {}
- description: The device group for which to return addresses (Panorama instances).
  key: device-group
  playbookInputQuery:
  required: false
  value: {}
- description: Tag for which to filter the rules.
  key: tag
  playbookInputQuery:
  required: false
  value: {}
name: PAN-OS - Block all unknown and unauthorized applications
outputs: []
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "1"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 73652d5d-e0d6-4ace-8ae4-9156517f4a21
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 73652d5d-e0d6-4ace-8ae4-9156517f4a21
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
  "1":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                filters:
                - - left:
                      iscontext: true
                      value:
                        simple: modules.brand
                    operator: isEqualString
                    right:
                      value:
                        simple: Panorama
                - - left:
                      iscontext: true
                      value:
                        simple: modules.state
                    operator: isEqualString
                    right:
                      value:
                        simple: active
                root: modules
          operator: isExists
      label: "yes"
    id: "1"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "3"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 18b8e23d-981f-4182-87d5-f02b8f64d24e
      iscommand: false
      name: Is PAN-OS integration enabled?
      description: "Is PAN-OS integration enabled?"
      type: condition
      version: -1
    taskid: 18b8e23d-981f-4182-87d5-f02b8f64d24e
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 450,
          "y": 180
        }
      }
  "2":
    id: "2"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 2b9c5f2c-95cb-4eb6-8500-4a3409d8ee11
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 2b9c5f2c-95cb-4eb6-8500-4a3409d8ee11
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1200
        }
      }
  "3":
    id: "3"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "4"
    note: false
    quietmode: 0
    scriptarguments:
      device-group:
        complex:
          root: inputs.device-group
      pre_post:
        complex:
          root: inputs.pre-post-rulebase
      tag:
        complex:
          root: inputs.tag
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Returns a list of predefined Security Rules.
      id: ef7878c5-0fed-4be0-8c65-041afa365547
      iscommand: true
      name: PAN-OS - List rules
      script: '|||pan-os-list-rules'
      type: regular
      version: -1
    taskid: ef7878c5-0fed-4be0-8c65-041afa365547
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 760,
          "y": 350
        }
      }
  "4":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                filters:
                - - left:
                      iscontext: true
                      value:
                        simple: Panorama.SecurityRule.Action
                    operator: isEqualString
                    right:
                      value:
                        simple: allow
                - - left:
                      iscontext: true
                      value:
                        simple: Panorama.SecurityRule.Service
                    operator: isEqualString
                    right:
                      value:
                        simple: any
                root: Panorama.SecurityRule
          operator: isExists
      label: "yes"
    id: "4"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "6"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Is there a rule that allows application as any?
      id: 89005b06-9fb0-4678-8717-145b0ae8faed
      iscommand: false
      name: Is there a rule that allows application as any?
      type: condition
      version: -1
    taskid: 89005b06-9fb0-4678-8717-145b0ae8faed
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 760,
          "y": 520
        }
      }
  "5":
    id: "5"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      device-group:
        complex:
          root: inputs.device-group
      pre_post:
        complex:
          root: inputs.pre_post
      rulename:
        complex:
          accessor: Name
          filters:
          - - left:
                iscontext: true
                value:
                  simple: Panorama.SecurityRule.Action
              operator: isEqualString
              right:
                value:
                  simple: allow
          - - left:
                iscontext: true
                value:
                  simple: Panorama.SecurityRule.Service
              operator: isEqualString
              right:
                value:
                  simple: any
          root: Panorama.SecurityRule
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Deletes a policy rule.
      id: 8a6eb138-e0c4-4c0a-8070-552ca171c950
      iscommand: true
      name: PAN-OS - Delete rule
      script: '|||pan-os-delete-rule'
      type: regular
      version: -1
    taskid: 8a6eb138-e0c4-4c0a-8070-552ca171c950
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 860
        }
      }
  "6":
    id: "6"
    ignoreworker: false
    nexttasks:
      "no":
      - "2"
      "yes":
      - "5"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Choose whether to delete the rule.
      id: ab4c14d4-d41e-40fa-8eaa-9ccb804aa5ba
      iscommand: false
      name: Delete rule?
      type: condition
      version: -1
    taskid: ab4c14d4-d41e-40fa-8eaa-9ccb804aa5ba
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 950,
          "y": 690
        }
      }
  "7":
    id: "7"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "2"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 9b883bd0-ba88-4a79-8cf7-a0fbba7945f5
      iscommand: false
      name: PAN-OS Commit Configuration
      playbookId: PAN-OS Commit Configuration
      type: playbook
      version: -1
      description: ''
    taskid: 9b883bd0-ba88-4a79-8cf7-a0fbba7945f5
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 1030
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "1_2_#default#": 0.2,
      "4_2_#default#": 0.33,
      "6_2_no": 0.33
    },
    "paper": {
      "dimensions": {
        "height": 1215,
        "width": 1080,
        "x": 450,
        "y": 50
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform