Palo alto intrazone and interzone rules

[Bumenang]

I want to be alerted if the Palo Alto default intrazone or interzone rules are ever set to "allow".

[PavelK]

Thank you for the post @Bumenang

one way to go about it is to configure all Firewalls to send configuration logs to Panorama. This setting is under: Device > Log Settings > Configuration > [Configure new profile and select Panorama check box]. Then in Panorama configure under: Device > Log Settings > Configuration a new Configuration profile with below filter:

( full-path contains 'rulebase/default-security-rules/rules/entry[@name=\'intrazone-default\']' ) or ( full-path contains 'rulebase/default-security-rules/rules/entry[@name=\'interzone-default\']' )

and add an email profile:

With the above configuration every time, somebody changes intrazone-default or interzone-default rules, you will get an email alert.

Kind Regards

Pavel

[Bumenang]

Thanks very much Pavel.

Please would you know how i can input this via code (Terraform)?