How to verify WAF IDS & IPS configuration in Palo-alto firewall?

[ChandrashekharD]

Dear Friends,

We have a customer who is performing  Network related technical assessment

He wants to know the below details from us

1)WAF>>Screenshot showing WAF deployed and enabled

2)IDS&IPS >>Screenshot showing IDS/IPS enabled

3)Screenshot showing M365, firewall, and proxy server logs being collected

How to verify WAF IDS & IPS configuration in Palo-alto firewall?

Please guide us to collect these above details. 

Regards,

Chandrashekhar

[JayGolf · Accepted solution]

Hi @ChandrashekharD ,

Your Security Profiles serve as your IDS/IPS settings you can enforce on your policies. I would recommend showing and explaining your Security Policies -> Profile Setting related to the customer environment. Additionally, you can include a screenshot of the actual Security Profile Group to show which features you have enabled within the group and share a screenshot of the individual Antivirus, Anti-Spyware, Vulnerability Protection, etc. profiles. 

For 1) Do you have a dedicated WAF? 

For 3) You can provide M365 and "firewall" logs via your Monitor tab. I would confirm with the customer/audit team and ask to be more specific in their request so you can provide EXACT logs. M365 and firewall logs to which server and from where? It sounds like you might manage multiple customers and in that situation, it's best to show only what pertains to the specific customer.