PANW-IP-000001 - The Palo Alto Networks security platform must enable Antivirus, Anti-spyware, and Vulnerability Protection for all authorized traffic - Antivirus Profiles

CAT|II

CCI|CCI-001368

Rule-ID|SV-207688r557390_rule

STIG-ID|PANW-IP-000001

STIG-Legacy|SV-77137

STIG-Legacy|V-62647

Vuln-ID|V-207688

PANW-IP-000001 - The Palo Alto Networks security platform must enable Antivirus, Anti-spyware, and Vulnerability Protection for all authorized traffic - Antivirus Services

PANW-IP-000007 - The Palo Alto Networks security platform must produce audit records containing information to establish the source of the event, including, at a minimum, originating source address.

CCI|CCI-000133

Rule-ID|SV-207689r767016_rule

STIG-ID|PANW-IP-000007

STIG-Legacy|SV-77139

STIG-Legacy|V-62649

Vuln-ID|V-207689

PANW-IP-000008 - The Palo Alto Networks security platform must capture traffic of detected/dropped malicious code.

CCI|CCI-000134

Rule-ID|SV-207690r559743_rule

STIG-ID|PANW-IP-000008

STIG-Legacy|SV-77141

STIG-Legacy|V-62651

Vuln-ID|V-207690

PANW-IP-000010 - In the event of a logging failure caused by the lack of audit record storage capacity, the Palo Alto Networks security platform must continue generating and storing audit records if possible, overwriting the oldest audit records in a first-in-first-out manner.

CCI|CCI-000140

Rule-ID|SV-207691r557390_rule

STIG-ID|PANW-IP-000010

STIG-Legacy|SV-77143

STIG-Legacy|V-62653

Vuln-ID|V-207691

PANW-IP-000018 - The Palo Alto Networks security platform must have a DoS Protection Profile for outbound traffic applied to a policy for traffic originating from the internal zone going to the external zone.

CCI|CCI-001095

Rule-ID|SV-207692r557390_rule

STIG-ID|PANW-IP-000018

STIG-Legacy|SV-77145

STIG-Legacy|V-62655

Vuln-ID|V-207692

PANW-IP-000020 - The Palo Alto Networks security platform must detect and deny any prohibited mobile or otherwise malicious code at the enclave boundary - antivirus rules

CCI|CCI-001662

Rule-ID|SV-207693r768712_rule

STIG-ID|PANW-IP-000020

STIG-Legacy|SV-77147

STIG-Legacy|V-62657

Vuln-ID|V-207693

PANW-IP-000020 - The Palo Alto Networks security platform must detect and deny any prohibited mobile or otherwise malicious code at the enclave boundary - security rules

PANW-IP-000024 - The Palo Alto Networks security platform must install updates for application software files, signature definitions, detection heuristics, and vendor-provided rules when new releases are available in accordance with organizational configuration management policy and procedures.

CCI|CCI-001240

Rule-ID|SV-207694r557390_rule

STIG-ID|PANW-IP-000024

STIG-Legacy|SV-77149

STIG-Legacy|V-62659

Vuln-ID|V-207694

PANW-IP-000026 - The Palo Alto Networks security platform must detect and drop any prohibited mobile or otherwise malicious code at internal boundaries - Antivirus Profiles

CCI|CCI-001243

Rule-ID|SV-207695r557390_rule

STIG-ID|PANW-IP-000026

STIG-Legacy|SV-77151

STIG-Legacy|V-62661

Vuln-ID|V-207695

PANW-IP-000026 - The Palo Alto Networks security platform must detect and drop any prohibited mobile or otherwise malicious code at internal boundaries - Antivirus Services

PANW-IP-000028 - The Palo Alto Networks security platform must send an immediate (within seconds) alert to, at a minimum, the SA when malicious code is detected - within seconds alert when malicious code is detected.

Rule-ID|SV-207696r557390_rule

STIG-ID|PANW-IP-000028

STIG-Legacy|SV-77153

STIG-Legacy|V-62663

Vuln-ID|V-207696

PANW-IP-000029 - The Palo Alto Networks security platform must automatically install updates to signature definitions, detection heuristics, and vendor-provided rules.

CCI|CCI-001247

Rule-ID|SV-207697r557390_rule

STIG-ID|PANW-IP-000029

STIG-Legacy|SV-77155

STIG-Legacy|V-62665

Vuln-ID|V-207697

PANW-IP-000030 - The Palo Alto Networks security platform must block outbound ICMP Destination Unreachable, Redirect, and Address Mask reply messages.

CCI|CCI-001312

Rule-ID|SV-207698r557390_rule

STIG-ID|PANW-IP-000030

STIG-Legacy|SV-77157

STIG-Legacy|V-62667

Vuln-ID|V-207698

PANW-IP-000031 - The Palo Alto Networks security platform must block malicious ICMP packets.

Rule-ID|SV-207699r557390_rule

STIG-ID|PANW-IP-000031

STIG-Legacy|SV-77159

STIG-Legacy|V-62669

Vuln-ID|V-207699

PANW-IP-000032 - To protect against unauthorized data mining, the Palo Alto Networks security platform must detect and prevent SQL and other code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

CCI|CCI-002346

Rule-ID|SV-207700r557390_rule

STIG-ID|PANW-IP-000032

STIG-Legacy|SV-77161

STIG-Legacy|V-62671

Vuln-ID|V-207700

PANW-IP-000033 - To protect against unauthorized data mining, the Palo Alto Networks security platform must detect and prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

Rule-ID|SV-207701r557390_rule

STIG-ID|PANW-IP-000033

STIG-Legacy|SV-77163

STIG-Legacy|V-62673

Vuln-ID|V-207701

PANW-IP-000039 - The Palo Alto Networks security platform must off-load log records to a centralized log server.

CAT|III

CCI|CCI-001851

Rule-ID|SV-207702r557390_rule

STIG-ID|PANW-IP-000039

STIG-Legacy|SV-77165

STIG-Legacy|V-62675

Vuln-ID|V-207702

PANW-IP-000041 - The Palo Alto Networks security platform must protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis (traffic thresholds) - DoS Protection Object

CCI|CCI-002385

Rule-ID|SV-207703r557390_rule

STIG-ID|PANW-IP-000041

STIG-Legacy|SV-77167

STIG-Legacy|V-62677

Vuln-ID|V-207703

PANW-IP-000041 - The Palo Alto Networks security platform must protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis (traffic thresholds) - DoS Protection Policy

PANW-IP-000043 - The Palo Alto Networks security platform must use a Vulnerability Protection Profile that blocks any critical, high, or medium threats.

Rule-ID|SV-207704r557390_rule

STIG-ID|PANW-IP-000043

STIG-Legacy|SV-77169

STIG-Legacy|V-62679

Vuln-ID|V-207704

PANW-IP-000045 - Palo Alto Networks security platform components, including sensors, event databases, and management consoles must integrate with a network-wide monitoring capability.

CCI|CCI-002656

Rule-ID|SV-207705r557390_rule

STIG-ID|PANW-IP-000045

STIG-Legacy|SV-77171

STIG-Legacy|V-62681

Vuln-ID|V-207705

PANW-IP-000046 - The Palo Alto Networks security platform must detect use of network services that have not been authorized or approved by the ISSM and ISSO, at a minimum.

CCI|CCI-002683

Rule-ID|SV-207706r557390_rule

STIG-ID|PANW-IP-000046

STIG-Legacy|SV-77173

STIG-Legacy|V-62683

Vuln-ID|V-207706

PANW-IP-000047 - The Palo Alto Networks security platform must generate a log record when unauthorized network services are detected.

CCI|CCI-002684

Rule-ID|SV-207707r557390_rule

STIG-ID|PANW-IP-000047

STIG-Legacy|SV-77175

STIG-Legacy|V-62685

Vuln-ID|V-207707

PANW-IP-000048 - The Palo Alto Networks security platform must generate an alert to the ISSO and ISSM, at a minimum, when unauthorized network services are detected.

Rule-ID|SV-207708r557390_rule

STIG-ID|PANW-IP-000048

STIG-Legacy|SV-77177

STIG-Legacy|V-62687

Vuln-ID|V-207708

PANW-IP-000049 - The Palo Alto Networks security platform must continuously monitor inbound communications traffic for unusual/unauthorized activities or conditions.

CCI|CCI-002661

Rule-ID|SV-207709r557390_rule

STIG-ID|PANW-IP-000049

STIG-Legacy|SV-77179

STIG-Legacy|V-62689

Vuln-ID|V-207709

PANW-IP-000050 - The Palo Alto Networks security platform must continuously monitor outbound communications traffic for unusual/unauthorized activities or conditions.

CCI|CCI-002662

Rule-ID|SV-207710r557390_rule

STIG-ID|PANW-IP-000050

STIG-Legacy|SV-77181

STIG-Legacy|V-62691

Vuln-ID|V-207710

PANW-IP-000051 - The Palo Alto Networks security platform must send an alert to, at a minimum, the ISSO and ISSM when intrusion detection events are detected which indicate a compromise or potential for compromise.

CCI|CCI-002664

Rule-ID|SV-207711r557390_rule

STIG-ID|PANW-IP-000051

STIG-Legacy|SV-77183

STIG-Legacy|V-62693

Vuln-ID|V-207711

PANW-IP-000052 - The Palo Alto Networks security platform must send an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected.

Rule-ID|SV-207712r557390_rule

STIG-ID|PANW-IP-000052

STIG-Legacy|SV-77185

STIG-Legacy|V-62695

Vuln-ID|V-207712

PANW-IP-000053 - The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when rootkits or other malicious software which allows unauthorized privileged or non-privileged access is detected.

Rule-ID|SV-207713r557390_rule

STIG-ID|PANW-IP-000053

STIG-Legacy|SV-77187

STIG-Legacy|V-62697

Vuln-ID|V-207713

PANW-IP-000055 - The Palo Alto Networks security platform must send an alert to, at a minimum, the ISSO and ISSM when denial of service incidents are detected.

Rule-ID|SV-207714r557390_rule

STIG-ID|PANW-IP-000055

STIG-Legacy|SV-77189

STIG-Legacy|V-62699

Vuln-ID|V-207714

PANW-IP-000056 - The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when new active propagation of malware infecting DoD systems or malicious code adversely affecting the operations and/or security of DoD systems is detected.

Rule-ID|SV-207715r557390_rule

STIG-ID|PANW-IP-000056

STIG-Legacy|SV-77191

STIG-Legacy|V-62701

Vuln-ID|V-207715

PANW-IP-000058 - The Palo Alto Networks security platform must off-load log records to a centralized log server in real-time.

Detections

Analytics

DISA STIG Palo Alto IDPS v2r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.3 Feb 21, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.2 Jun 10, 2022 Miscellaneous Metadata updated. References updated. See also link updated.
Revision 1.1 Apr 25, 2022 Miscellaneous Metadata updated. References updated.

Detections

Analytics

DISA STIG Palo Alto IDPS v2r2 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA STIG Palo Alto IDPS v2r2