What is the Palo Alto recommended standard for Vulnerabilty Profiles, is it to block Critical and High Alerts? or to block medium alerts as well?

[J.Yeleti]

What is the Palo Alto recommended standard for Vulnerabilty Profiles, is it to block Critical and High Alerts? or to block medium alerts as well?

[TomYoung]

Hi @J.Yeleti ,

The recommended standard in the documentation is to monitor and determine which ones you should block.   https://docs.paloaltonetworks.com/best-practices/internet-gateway-best-practices/best-practice-inter...

However, if you run a Best Practice Assessment (BPA) from Strata Cloud Manager (SCM) (formerly AIOps) (There is a free version.) or if you download a Day 1 Configuration from the Customer Service Portal (CSP), then you will get more specific guidelines.

Below is a screenshot of my Vulnerability Profiles from the Day 1 Configuration fine-tuned with recommendations from the BPA.  Medium vulnerabilities are blocked for inbound and outbound traffic, but alerted for internal traffic.

Thanks,

Tom