Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
03-28-2022 11:55 AM - edited 06-10-2022 01:45 PM
Configuration Wizard
Additional Best Practice Checks Support
This document provides detail on additional BPA checks that were recently added into Configuration Wizard.
Before we get into details we would like to provide a quick overview of Configuration Wizard. It’s a step-by-step configuration wizard that provides an intuitive, easy-to-use interface to configure firewalls to align with best practices. The Configuration Wizard takes the results of the BPA report and expedites the remediation process by outputting commands that can be easily pasted into any instance of PAN-OS and committed. This helps to configure their firewalls using existing applications and capabilities to properly secure their network.
Benefits of BPA+ include:
Best Practice Checks that can be remediate with Configuration Wizard
|
Category |
BPA Checks |
|
Objects |
WildFire Profile File Types Antivirus Profile Decoder WildFire Inline ML Action |
|
Device |
Report Grayware Files Enabled |
WildFire Profile File Types
Configure the firewall to forward files to WildFire for analysis. Through the WildFire Analysis Profile, all files being uploaded or downloaded will be sent to WildFire for analysis. The WildFire Profile File Types best practice check ensures all file types for all applications are sent to WildFire for analysis.
The WildFire Cloud and on-premises private cloud analyzes new files that the firewall hasn’t seen before. It sends all new files for all applications to WildFire for analysis and inspection. WildFire detects unknown threats in all file types and protects you against zero-day threats (new malware) and advanced persistent threats.
Antivirus Profile Decoder Wildfire Inline ML Action
The WildFire Action setting in Antivirus profiles blocks viruses that WildFire identifies in content signature updates in the Antivirus profile. The WildFire Decoder Actions best practice check ensures the decoders are set to reset-both, drop, reset-client, or reset-server in the WildFire Action column.
If users have a WildFire subscription, their firewalls receive zero-day malware signatures from the WildFire cloud, as fast as under a minute after the threat is discovered. The WildFire Action setting in Antivirus profiles is based on WildFire content signature updates.
Report Grayware Files Enabled
Wildfire submission logs would have a log event when a file sent to the Wildfire cloud for inspection was identified and given a verdict as Grayware file. If not enabled this log is not created and is created only for malware files.
When the Report Grayware Files option is enabled, details such as session information, Behavioral summary, Network Activity, Host Activity and more that are helpful in analytics. As a best practice, we recommend having a check mark on the Report Grayware File box under WildFire general Settings in Device Setup.
Feedback? contact us at bpaplus@paloaltonetworks.com
