topic Re: Handling of and Awareness of APP-ID shifts or new releases in General Topics

Handling of and Awareness of APP-ID shifts or new releases

Brandon_Wertz — Sat, 02 Dec 2023 20:40:52 GMT

I'm not sure how much it's been publicized, but there's a pretty significant improvement to how Palo is letting customers handle newly released APP-IDs or application shifts.

Thus far when new app-ids are released customers just have to accept them without really understanding if the coming change will effect existing security policy. Well finally Palo is doing something about it. Palo will create a "threat" signature that will be fired on a new "to be released" application. This "threat" alert will inform firewall admins about traffic that while is currently hitting a certain application will match a "to be released" / coming application.

Not only will this awareness exist. Palo is also creating a "Policy Optimizer" of sorts where admins can proactively add these coming applications to existing policy, or even create a new security rule with these new applications.

This is an amazing feature that will make handling new app-ids something Palo admins can finally say we have a process for. (I'm just a long time Palo admin sharing what I hope is some helpful news)

I wanted to bring awareness to the below blog post. It's in an area people might not always look at so I figured I'd share here.

https://live.paloaltonetworks.com/t5/customer-resources/app-id-change-threat-signature-indicator-tsid-announcement/ta-p/566776

Re: Handling of and Awareness of APP-ID shifts or new releases

kiwi — Tue, 05 Dec 2023 13:28:35 GMT

Hi @Brandon_Wertz ,

This is indeed another step forward !! Thanks for sharing !

One did already have the option to disable new applications in scheduled content updates so you weren't necessarily forced to just accept them:

https://live.paloaltonetworks.com/t5/blogs/tips-amp-tricks-disable-new-applications-in-scheduled-content/ba-p/554635

Thanks again !

Kim.

Re: Handling of and Awareness of APP-ID shifts or new releases

Brandon_Wertz — Tue, 05 Dec 2023 13:44:45 GMT

Yeah, there are ways, like creating an application filter that targets newly released applications and allows you to create policy, but that's really a guessing game. Disabling newly released apps is also a way, but that too is just kicking the can down the road and doesn't really allow admins to understand the change of policy implications on their security policy.

None of the existing options, IMO, were what you'd expect from a firewall security appliance.

This new feature squarely hits the target on what admins need to do to properly address application changes in a secured way.