Policy Optimizer - Generic

This playbook is triggered by the Policy Optimizer incident type, and can execute any of the following sub-playbooks: - Policy Optimizer - Manage Unused Rules - Policy Optimizer - Manage Rules with Unused Applications - Policy Optimizer - Manage Port Based Rules

PAN-OS Policy Optimizer (beta) · 11 tasks · 3 inputs · 0 outputs

Details

ID	`Policy Optimizer - Generic`
From Version	6.0.0
Tasks	11

README

This playbook is triggered by the Policy Optimizer incident type, and can execute any of the following sub-playbooks:

Policy Optimizer - Manage Unused Rules
Policy Optimizer - Manage Rules with Unused Applications
Policy Optimizer - Manage Port Based Rules

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Policy Optimizer - Manage Rules with Unused Applications
Policy Optimizer - Manage Port Based Rules
Policy Optimizer - Manage Unused Rules

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

setIncident

Playbook Inputs

Name	Description	Required
slack_user	Slack user to notify about unused rules.	Optional
email_address	User email address to notify about unused rules.	Optional
auto_commit	Specifies whether you want to auto-commit the configuration for the PAN-OS policy changes automatically (Yes/No).	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Policy Optimizer - Generic

Inputs

slack_user — Slack user to notify about unused rules.
email_address — User email address to notify about unused rules.
auto_commit — Specifies whether you want to auto-commit the configuration for the PAN-OS policy changes automatically (Yes/No).

Commands used

closeInvestigation setIncident

Flowchart

Source

playbook-Policy_Optimizer_-_Generic.yml

Download History Raw

id: Policy Optimizer - Generic
version: -1
name: Policy Optimizer - Generic
description: |-
  This playbook is triggered by the Policy Optimizer incident type, and can execute any of the following sub-playbooks:
  - Policy Optimizer - Manage Unused Rules
  - Policy Optimizer - Manage Rules with Unused Applications
  - Policy Optimizer - Manage Port Based Rules
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f962a7b0-cfd4-49fd-84b7-df1d173b932a
    type: start
    task:
      id: f962a7b0-cfd4-49fd-84b7-df1d173b932a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 14ccf9b1-f86f-4e8d-898c-09b0f1a53b3d
    type: playbook
    task:
      id: 14ccf9b1-f86f-4e8d-898c-09b0f1a53b3d
      version: -1
      name: Policy Optimizer - Manage Port Based Rules
      playbookName: Policy Optimizer - Manage Port Based Rules
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      auto_commit:
        complex:
          root: inputs.auto_commit
      email_address:
        complex:
          root: inputs.email_address
      slack_user:
        complex:
          root: inputs.slack_user
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 480,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 4476823f-a9a9-49f8-8e9b-360ec85041b4
    type: playbook
    task:
      id: 4476823f-a9a9-49f8-8e9b-360ec85041b4
      version: -1
      name: Policy Optimizer - Manage Unused Rules
      playbookName: Policy Optimizer - Manage Unused Rules
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      auto_commit:
        complex:
          root: inputs.auto_commit
      email_address:
        complex:
          root: inputs.email_address
      slack_user:
        complex:
          root: inputs.slack_user
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 910,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: a4ab8365-7487-44cd-8f88-93bb340faa7a
    type: condition
    task:
      id: a4ab8365-7487-44cd-8f88-93bb340faa7a
      version: -1
      name: Manage Unused Applications
      description: "Manage Unused Applications?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      Manage Unused Applications:
      - "8"
    separatecontext: false
    conditions:
    - label: Manage Unused Applications
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: policyoptimizerusecase
            iscontext: true
          right:
            value:
              simple: Manage Rules with Unused Applications
    view: |-
      {
        "position": {
          "x": 40,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: c2218b78-eefa-4c61-8b29-e976cf47eafb
    type: condition
    task:
      id: c2218b78-eefa-4c61-8b29-e976cf47eafb
      version: -1
      name: Close the investigation?
      description: "Close the investigation?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "Yes":
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 9609c78d-8150-43b0-82e8-b3c2b3839b3b
    type: condition
    task:
      id: 9609c78d-8150-43b0-82e8-b3c2b3839b3b
      version: -1
      name: Manage Port Based Rules
      description: "Manage Port Based Rules?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      Manage Port Based Rules:
      - "1"
    separatecontext: false
    conditions:
    - label: Manage Port Based Rules
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: policyoptimizerusecase
            iscontext: true
          right:
            value:
              simple: Manage Port Based Rules
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 6f03341e-b8d1-4ce7-876d-cde730c496bb
    type: condition
    task:
      id: 6f03341e-b8d1-4ce7-876d-cde730c496bb
      version: -1
      name: Manage Unused Rules
      description: "Manage Unused Rules?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      Manage Unused Rules:
      - "3"
    separatecontext: false
    conditions:
    - label: Manage Unused Rules
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: policyoptimizerusecase
            iscontext: true
          right:
            value:
              simple: Manage Unused Rules
    view: |-
      {
        "position": {
          "x": 910,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 616d96d9-20ab-415b-8c13-d2734110eb0e
    type: playbook
    task:
      id: 616d96d9-20ab-415b-8c13-d2734110eb0e
      version: -1
      name: Policy Optimizer - Manage Rules with Unused Applications
      playbookName: Policy Optimizer - Manage Rules with Unused Applications
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      auto_commit:
        complex:
          root: inputs.auto_commit
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 40,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: d9379699-dda4-41b0-87ee-5ae6c7cd75dd
    type: regular
    task:
      id: d9379699-dda4-41b0-87ee-5ae6c7cd75dd
      version: -1
      name: Set description in layout
      description: Set the use-case details to the layout.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "4"
      - "6"
      - "7"
    scriptarguments:
      usecasedescription:
        simple: |-
          This incident shows information about PAN-OS policy misconfigurations found by the PAN-OS Policy Optimizer that help automate your AppID adoption. See the different use-cases displayed in the layout tabs.

          Manage unused rules - Identify and remove unused rules that do not pass traffic in your environment.

          Manage port based rules - Migrate port-based rules to application-based allow rules to reduce the attack surface and safely enable applications on your network.

          Manage rules with unused applications - If you have application-based Security policy rules that allow a large number of applications, you can remove unused applications (applications never seen on the rules) from those rules to only allow applications actually seen in the rule’s traffic. This strengthens your security posture by reducing the attack surface.
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 6551b126-9098-4340-8b34-23067b38e568
    type: regular
    task:
      id: 6551b126-9098-4340-8b34-23067b38e568
      version: -1
      name: Close investigation
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 760,
          "y": 720
          }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 30fad76e-d825-432c-87b7-4b39a065d50c
    type: title
    task:
      id: 30fad76e-d825-432c-87b7-4b39a065d50c
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "5_11_#default#": 0.44
    },
    "paper": {
      "dimensions": {
        "height": 1075,
        "width": 1250,
        "x": 40,
        "y": -120
      }
    }
  }
inputs:
- key: slack_user
  value: {}
  required: false
  description: Slack user to notify about unused rules.
  playbookInputQuery:
- key: email_address
  value: {}
  required: false
  description: User email address to notify about unused rules.
  playbookInputQuery:
- key: auto_commit
  value: {}
  required: false
  description: Specifies whether you want to auto-commit the configuration for the PAN-OS
    policy changes automatically (Yes/No).
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0