PAN-OS - Enforce WildFire Best Practices Profile

This playbook enforces the WildFire Best Practices Profile as defined by Palo Alto Networks BPA. The playbook performs the following tasks: - Check for WildFire license (If license is not activated, the playbook refers users to their Palo Alto Networks account manager for further instructions). - Get the existing profile information. - Get the best practices profile information. - Check if the best practices profile set by Cortex XSOAR is enforced. (If not, the playbook allows the user to compare the existing profile with the best practices and decide on the action to take). - Create best practices profile. - Apply profile to policy rules on PAN-OS firewall or Panorama.

MITRE ATT&CK - Courses of Action · 36 tasks · 4 inputs · 0 outputs

Inputs

  • template — Template name to enforce WildFire best practices profile.
  • device-group — The device group to work on. Exists only in panorama!
  • tag — Tag for which to filter the results.
  • pre-post-rulebase — Determines whether the rule is a pre-rulebase or post-rulebase rule, according to the rule structure. Exists only in panorama!

Commands used

pan-os-create-wildfire-best-practice-profile pan-os-enforce-wildfire-best-practice pan-os-get-licenses pan-os-get-security-profiles pan-os-get-wildfire-best-practice setIncident

Flowchart

yes yes yes yes yes yes Start Start Panorama - Get Licenses - pan-os-get-licenses Panorama - Get Licenses pan-os-get-licenses Is there a WildFire license? Is there a WildFire license? Missing License Missing License PAN-OS - Get security profiles - pan-os-get-security-profiles PAN-OS - Get security pro... pan-os-get-security-profiles PAN-OS - Get WildFire best practice - pan-os-get-wildfire-best-practice PAN-OS - Get WildFire bes... pan-os-get-wildfire-best-prac... Set existing WildFire profile Set existing WildFire pro... Delete context Delete context Is WildFire best practice profile by XSOAR enforced? Is WildFire best practice... Done Done PAN-OS - Create WildFire best practice profile - pan-os-create-wildfire-best-practice-profile PAN-OS - Create WildFire ... pan-os-create-wildfire-best-p... PAN-OS - Enforce WildFire best practice - pan-os-enforce-wildfire-best-practice PAN-OS - Enforce WildFire... pan-os-enforce-wildfire-best-... Is PAN-OS integration enabled? Is PAN-OS integration ena... Missing License - Please contact your Palo Alto Networks account manager Missing License - Please ... Enforce WildFire best practices? Enforce WildFire best pra... Apply profile to policy rule? Apply profile to policy r... PAN-OS Apply profile to a rule PAN-OS Apply profile to a... PAN-OS - Apply Security Profile to Policy Rule - PAN-OS - Apply Security Profile to Policy Rule PAN-OS - Apply Security P... PAN-OS - Apply Security Profi... PAN-OS Commit Configuration - PAN-OS Commit Configuration PAN-OS Commit Configuration PAN-OS Commit Configuration Export WildFire existing profiles to CSV Export WildFire existing ... Export WildFire best practices to CSV Export WildFire best prac... Create WildFire best practice profile? Create WildFire best prac... Remediation and Policy Updates Remediation and Policy Up... Gather Profiles Information Gather Profiles Information BPA profile exists BPA profile exists Set best practices profile information to the layout - setIncident Set best practices profil... setIncident BPA profile created BPA profile created Set best practices profile information to the layout - setIncident Set best practices profil... setIncident Set Profile information to layout Set Profile information t... Set best practices profile rules to the layout - setIncident Set best practices profil... setIncident Not according to BPA Not according to BPA Set best practices profile information to the layout - setIncident Set best practices profil... setIncident Trigger BPA Scan Trigger BPA Scan Palo Alto Networks BPA - Submit Scan - 629bfb7f-d719-4b74-8f1b-7f5a97b816db Palo Alto Networks BPA - ... 629bfb7f-d719-4b74-8f1b-7f5a9... Set rules information to the layout - setIncident Set rules information to ... setIncident Set BPA scan results to the layout - setIncident Set BPA scan results to t... setIncident