Policy Optimizer - Manage Port Based Rules

This playbook migrates port-based rules to application-based allow rules to reduce the attack surface and safely enable applications on your network.

PAN-OS Policy Optimizer (beta) · 24 tasks · 3 inputs · 0 outputs

Inputs

  • slack_user — Slack user to notify about port based rules.
  • email_address — User email address to notify about port based rules.
  • auto_commit — Specifies whether you want to auto-commit the configuration for the PAN-OS policy changes automatically (Yes/No).

Commands used

pan-os-delete-rule pan-os-po-no-apps

Flowchart

yes yes yes yes Delete rule Edit rule yes yes Yes yes Start Start Is PAN-OS Policy Optimizer integration available? - IsIntegrationAvailable Is PAN-OS Policy Optimize... IsIntegrationAvailable Done Done Manage Port Based Rules Manage Port Based Rules PAN-OS - Get policies with no apps - pan-os-po-no-apps PAN-OS - Get policies wit... pan-os-po-no-apps Are there any policies with no apps? Are there any policies wi... Notify Notify Is there an email address? Is there an email address? Is there a slack user? Is there a slack user? Take action Take action Send mail Send mail Send slack message Send slack message Choose action to take Choose action to take PAN-OS - Delete Rule - pan-os-delete-rule PAN-OS - Delete Rule pan-os-delete-rule Manually handle port based rules Manually handle port base... Is PAN-OS integration available? - IsIntegrationAvailable Is PAN-OS integration ava... IsIntegrationAvailable Auto-commit configuration input enabled? Auto-commit configuration... PAN-OS Commit Configuration - PAN-OS Commit Configuration PAN-OS Commit Configuration PAN-OS Commit Configuration Automatically commit PAN-OS configuration? Automatically commit PAN-... Manually commit PAN-OS configuration Manually commit PAN-OS co... Policy Optimizer - Add Applications to Policy Rules - Policy Optimizer - Add Applications to Policy Rules Policy Optimizer - Add Ap... Policy Optimizer - Add Applic... Choose rules to delete Choose rules to delete No communication input configured? No communication input co... Ask by task only Ask by task only