topic How to verify WAF IDS & IPS configuration in Palo-alto firewall? in General Topics

topic How to verify WAF IDS & IPS configuration in Palo-alto firewall? in General Topics https://live.paloaltonetworks.com/t5/general-topics/how-to-verify-waf-ids-amp-ips-configuration-in-palo-alto/m-p/580534#M116267 <DIV>Dear Friends,</DIV> <DIV> </DIV> <DIV>We have a customer who is performing  Network related technical assessment</DIV> <DIV>He wants to know the below details from us</DIV> <DIV> </DIV> <DIV>1)WAF>>Screenshot showing WAF deployed and enabled</DIV> <DIV>2)IDS&IPS >>Screenshot showing IDS/IPS enabled</DIV> <DIV>3)Screenshot showing M365, firewall, and proxy server logs being collected</DIV> <DIV> </DIV> <DIV>How to verify WAF IDS & IPS configuration in Palo-alto firewall?</DIV> <DIV>Please guide us to collect these above details. </DIV> <DIV> </DIV> <DIV>Regards,</DIV> <DIV>Chandrashekhar</DIV> Fri, 15 Mar 2024 16:23:06 GMT ChandrashekharD 2024-03-15T16:23:06Z How to verify WAF IDS & IPS configuration in Palo-alto firewall? https://live.paloaltonetworks.com/t5/general-topics/how-to-verify-waf-ids-amp-ips-configuration-in-palo-alto/m-p/580534#M116267 <DIV>Dear Friends,</DIV> <DIV> </DIV> <DIV>We have a customer who is performing  Network related technical assessment</DIV> <DIV>He wants to know the below details from us</DIV> <DIV> </DIV> <DIV>1)WAF>>Screenshot showing WAF deployed and enabled</DIV> <DIV>2)IDS&IPS >>Screenshot showing IDS/IPS enabled</DIV> <DIV>3)Screenshot showing M365, firewall, and proxy server logs being collected</DIV> <DIV> </DIV> <DIV>How to verify WAF IDS & IPS configuration in Palo-alto firewall?</DIV> <DIV>Please guide us to collect these above details. </DIV> <DIV> </DIV> <DIV>Regards,</DIV> <DIV>Chandrashekhar</DIV> Fri, 15 Mar 2024 16:23:06 GMT https://live.paloaltonetworks.com/t5/general-topics/how-to-verify-waf-ids-amp-ips-configuration-in-palo-alto/m-p/580534#M116267 ChandrashekharD 2024-03-15T16:23:06Z Re: How to verify WAF IDS & IPS configuration in Palo-alto firewall? https://live.paloaltonetworks.com/t5/general-topics/how-to-verify-waf-ids-amp-ips-configuration-in-palo-alto/m-p/580538#M116268 <P>Hi <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/300806">@ChandrashekharD</a> ,</P> <P> </P> <P>Your Security Profiles serve as your IDS/IPS settings you can enforce on your policies. I would recommend showing and explaining your <STRONG>Security Policies -> Profile Setting </STRONG>related to the customer environment. Additionally, you can include a screenshot of the actual <STRONG>Security Profile Group</STRONG> to show which features you have enabled within the group and share a screenshot of the individual <STRONG>Antivirus</STRONG>, <STRONG>Anti-Spyware</STRONG>, <STRONG>Vulnerability Protection</STRONG>, etc. profiles. </P> <P> </P> <P>For 1) Do you have a dedicated WAF? </P> <P> </P> <P>For 3) You can provide M365 and "firewall" logs via your Monitor tab. I would confirm with the customer/audit team and ask to be more specific in their request so you can provide EXACT logs. M365 and firewall logs to which server and from where? It sounds like you might manage multiple customers and in that situation, it's best to show only what pertains to the specific customer. </P> Fri, 15 Mar 2024 17:28:58 GMT https://live.paloaltonetworks.com/t5/general-topics/how-to-verify-waf-ids-amp-ips-configuration-in-palo-alto/m-p/580538#M116268 JayGolf 2024-03-15T17:28:58Z