I was messing around in the interface today and had a thought as for rules and am curious what other might think.
I created a group of rules for a particular zone/AD User group. Something like this
Allow but do not log (DNS for example)
Allow these apps (Appgrp--custom application group)
Allow risk1 (custom app filter includes all "risk 1" apps)
Allow risk2 (custom app filter includes all "risk 2" apps)
Allow risk3 (custom app filter includes all "risk 3" apps)
Allow risk4 (custom app filter includes all "risk 4" apps)
Deny risk5 (custom app filter includes all "risk 5" apps)
My thinking is that I could monitor Risk 3,4,5 and add the appropriate apps to the custom app group "Appgrp" and eventully make levels 4 and 5 (possible risk 3) deny rules.
Any thoughts would be appreciated,
It is an interesting take on using the risk value. In my experience we tend to only be interested in the risk value when looking into reports and what applications we have running on our networks (like a big fat red block for bit-torrent in the new ACC).
I would advise in taking a look at the security policy fundamentals documents
and also keeping a keen eye on the application and threats release notes. With PanOS 7, a new feature has been implemented in which you can see what modifications a new version will have to your device.
Let us know how you get on.
The other consideration here is business risk for false positive blocks. Applications that are business critical my need to be treated with kid gloves on their action with threat profiles. Setting the action to alert rather than block to prevent fals positives from blocking critical workflows.
After which you need a regular procedure to review the alerts and insure all is well with the affected workstations.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!