https://live.paloaltonetworks.com/t5/globalprotect-discussions/globalprotect-autoblock-kick-users-when-vulnerability-exploit-is/m-p/431168#M1681 <P>I'm curious if anyone has crafted either a vulnerability profile or security policy that would disconnect or auto-block a user if their a vulnerability exploit is attempted while they are connected via Globalprotect. We've set up event logging that can flag and email my team whenever a user starts displaying malicious or compromised behavior when connected via Globalprotect, but we'd like to take it a step further and auto-block and/or disconnect a suspicious user.&nbsp;</P><P>&nbsp;</P><P>Thoughts?</P> Thu, 02 Sep 2021 18:39:18 GMT DougSirek107 2021-09-02T18:39:18Z https://live.paloaltonetworks.com/t5/globalprotect-discussions/globalprotect-autoblock-kick-users-when-vulnerability-exploit-is/m-p/431168#M1681 <P>I'm curious if anyone has crafted either a vulnerability profile or security policy that would disconnect or auto-block a user if their a vulnerability exploit is attempted while they are connected via Globalprotect. We've set up event logging that can flag and email my team whenever a user starts displaying malicious or compromised behavior when connected via Globalprotect, but we'd like to take it a step further and auto-block and/or disconnect a suspicious user.&nbsp;</P><P>&nbsp;</P><P>Thoughts?</P> Thu, 02 Sep 2021 18:39:18 GMT https://live.paloaltonetworks.com/t5/globalprotect-discussions/globalprotect-autoblock-kick-users-when-vulnerability-exploit-is/m-p/431168#M1681 DougSirek107 2021-09-02T18:39:18Z https://live.paloaltonetworks.com/t5/globalprotect-discussions/globalprotect-autoblock-kick-users-when-vulnerability-exploit-is/m-p/431564#M1684 <P>How about dynamic IP tagging based on info from threat logs?&nbsp;<A href="https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-auto-tagging-to-automate-security-actions.html" target="_blank">https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-auto-tagging-to-automate-security-actions.html</A></P><P>&nbsp;</P><P>In a nutshell, you have a log forwarding profile that hits on whatever threats you want (medium and higher, etc.), and it can do several things: forwards to syslog/panorama/datalake, sends admin an email alert, sends SNMP trap, <STRONG>tags the IP. </STRONG>You will make an address group based on this tag and create a security rule that blocks this traffic, sends to an alert page, etc. The duration of block is determined in the log fwd profile.</P> Fri, 03 Sep 2021 22:57:25 GMT https://live.paloaltonetworks.com/t5/globalprotect-discussions/globalprotect-autoblock-kick-users-when-vulnerability-exploit-is/m-p/431564#M1684 BenKnorr2 2021-09-03T22:57:25Z