Policy Optimizer - Manage Rules with Unused Applications

This playbook helps identify and remove unused applications from security policy rules. If you have application-based security policy rules that allow a large number of applications, you can remove unused applications (applications never seen on the rules) from those rules to allow only applications actually seen in the rule’s traffic. This strengthens your security posture by reducing the attack surface.

PAN-OS Policy Optimizer (beta) · 24 tasks · 3 inputs · 0 outputs

Inputs

  • slack_user — Slack user to notify about port based rules.
  • email_address — User email address to notify about port based rules.
  • auto_commit — Specifies whether you want to auto-commit the configuration for the PAN-OS policy changes automatically (Yes/No).

Commands used

pan-os-delete-rule pan-os-po-unused-apps

Flowchart

yes yes yes yes Delete rule Edit rule yes yes Yes yes Start Start Is PAN-OS Policy Optimizer integration available? - IsIntegrationAvailable Is PAN-OS Policy Optimize... IsIntegrationAvailable Done Done Manage Port Based Rules Manage Port Based Rules PAN-OS - Get policies with unused apps - pan-os-po-unused-apps PAN-OS - Get policies wit... pan-os-po-unused-apps Are there any policies with unused apps? Are there any policies wi... Notify Notify Is there an email address? Is there an email address? Is there a slack user? Is there a slack user? Take action Take action Send mail Send mail Choose action to take Choose action to take PAN-OS - Delete Rule - pan-os-delete-rule PAN-OS - Delete Rule pan-os-delete-rule Manually handle rules with unused applications Manually handle rules wit... Is PAN-OS integration available? - IsIntegrationAvailable Is PAN-OS integration ava... IsIntegrationAvailable Auto-commit configuration input enabled? Auto-commit configuration... PAN-OS Commit Configuration - PAN-OS Commit Configuration PAN-OS Commit Configuration PAN-OS Commit Configuration Automatically commit PAN-OS configuration? Automatically commit PAN-... Manually commit PAN-OS configuration Manually commit PAN-OS co... Policy Optimizer - Add Applications to Policy Rules - Policy Optimizer - Add Applications to Policy Rules Policy Optimizer - Add Ap... Policy Optimizer - Add Applic... Choose rules to delete Choose rules to delete Send Slack message Send Slack message No communication input configured? No communication input co... Ask by task only Ask by task only