PANW-NM-000015 - The Palo Alto Networks security platform must enforce the limit of three consecutive invalid logon attempts.

CAT|II

CCI|CCI-000044

Rule-ID|SV-228639r513524_rule

STIG-ID|PANW-NM-000015

STIG-Legacy|SV-77195

STIG-Legacy|V-62705

Vuln-ID|V-228639

PANW-NM-000016 - The Palo Alto Networks security platform must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

CAT|III

CCI|CCI-000048

Rule-ID|SV-228640r513527_rule

STIG-ID|PANW-NM-000016

STIG-Legacy|SV-77197

STIG-Legacy|V-62707

Vuln-ID|V-228640

PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur - Configuration Logs 'CRITICAL'

CCI|CCI-000172

Rule-ID|SV-228642r513532_rule

STIG-ID|PANW-NM-000024

STIG-Legacy|SV-77201

STIG-Legacy|V-62711

Vuln-ID|V-228642

PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur - Configuration Logs 'HIGH'

PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur - Configuration Logs 'INFORMATIONAL'

PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur - Configuration Logs 'LOW'

PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur - Configuration Logs 'MEDIUM'

PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur - System Logs 'CRITICAL'

PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur - System Logs 'HIGH'

PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur - System Logs 'INFORMATIONAL'

PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur - System Logs 'LOW'

PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur - System Logs 'MEDIUM'

PANW-NM-000029 - The Palo Alto Networks security platform must produce audit log records containing information (FQDN, unique hostname, management IP address) to establish the source of events - 'Hostname'

CCI|CCI-000133

Rule-ID|SV-228643r513535_rule

STIG-ID|PANW-NM-000029

STIG-Legacy|SV-77203

STIG-Legacy|V-62713

Vuln-ID|V-228643

PANW-NM-000029 - The Palo Alto Networks security platform must produce audit log records containing information (FQDN, unique hostname, management IP address) to establish the source of events - 'Send Hostname in Syslog'

PANW-NM-000046 - The Palo Alto Networks security platform must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

CCI|CCI-000382

Rule-ID|SV-228645r513540_rule

STIG-ID|PANW-NM-000046

STIG-Legacy|SV-77207

STIG-Legacy|V-62717

Vuln-ID|V-228645

PANW-NM-000047 - The Palo Alto Networks security platform must uniquely identify and authenticate organizational administrators (or processes acting on behalf of organizational administrators).

CCI|CCI-000366

CCI|CCI-000764

Rule-ID|SV-228646r513543_rule

STIG-ID|PANW-NM-000047

STIG-Legacy|SV-77209

STIG-Legacy|V-62719

Vuln-ID|V-228646

PANW-NM-000051 - The Palo Alto Networks security platform must implement replay-resistant authentication mechanisms for network access to privileged accounts.

CCI|CCI-001941

Rule-ID|SV-228647r513546_rule

STIG-ID|PANW-NM-000051

STIG-Legacy|SV-77211

STIG-Legacy|V-62721

Vuln-ID|V-228647

PANW-NM-000053 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce a minimum 15-character password length.

CCI|CCI-000205

Rule-ID|SV-228648r513549_rule

STIG-ID|PANW-NM-000053

STIG-Legacy|SV-77213

STIG-Legacy|V-62723

Vuln-ID|V-228648

PANW-NM-000055 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce password complexity by requiring that at least one upper-case character be used.

CCI|CCI-000192

Rule-ID|SV-228650r513555_rule

STIG-ID|PANW-NM-000055

STIG-Legacy|SV-77217

STIG-Legacy|V-62727

Vuln-ID|V-228650

PANW-NM-000056 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce password complexity by requiring that at least one lower-case character be used.

CCI|CCI-000193

Rule-ID|SV-228651r513558_rule

STIG-ID|PANW-NM-000056

STIG-Legacy|SV-77219

STIG-Legacy|V-62729

Vuln-ID|V-228651

PANW-NM-000057 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce password complexity by requiring that at least one numeric character be used.

CCI|CCI-000194

Rule-ID|SV-228652r513561_rule

STIG-ID|PANW-NM-000057

STIG-Legacy|SV-77221

STIG-Legacy|V-62731

Vuln-ID|V-228652

PANW-NM-000058 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce password complexity by requiring that at least one special character be used.

CCI|CCI-001619

Rule-ID|SV-228653r513564_rule

STIG-ID|PANW-NM-000058

STIG-Legacy|SV-77223

STIG-Legacy|V-62733

Vuln-ID|V-228653

PANW-NM-000059 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must require that when a password is changed, the characters are changed in at least 8 of the positions within the password.

CCI|CCI-000195

Rule-ID|SV-228654r513567_rule

STIG-ID|PANW-NM-000059

STIG-Legacy|SV-77225

STIG-Legacy|V-62735

Vuln-ID|V-228654

PANW-NM-000061 - The Palo Alto Networks security platform must prohibit the use of unencrypted protocols for network access to privileged accounts.

CCI|CCI-000197

Rule-ID|SV-228655r513570_rule

STIG-ID|PANW-NM-000061

STIG-Legacy|SV-77227

STIG-Legacy|V-62737

Vuln-ID|V-228655

PANW-NM-000069 - The Palo Alto Networks security platform must terminate management sessions after 10 minutes of inactivity except to fulfill documented and validated mission requirements.

CAT|I

CCI|CCI-001133

Rule-ID|SV-228658r539622_rule

STIG-ID|PANW-NM-000069

STIG-Legacy|SV-77233

STIG-Legacy|V-62743

Vuln-ID|V-228658

PANW-NM-000075 - Administrators in the role of either Security Administrator or Cryptographic Administrator must not also have the role of Audit Administrator.

CCI|CCI-001314

Rule-ID|SV-228659r513582_rule

STIG-ID|PANW-NM-000075

STIG-Legacy|SV-77235

STIG-Legacy|V-62745

Vuln-ID|V-228659

PANW-NM-000092 - The Palo Alto Networks security platform must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.

CCI|CCI-002238

Rule-ID|SV-228660r513585_rule

STIG-ID|PANW-NM-000092

STIG-Legacy|SV-77237

STIG-Legacy|V-62747

Vuln-ID|V-228660

PANW-NM-000096 - The Palo Alto Networks security platform must generate an immediate alert when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.

CCI|CCI-001855

Rule-ID|SV-228661r513588_rule

STIG-ID|PANW-NM-000096

STIG-Legacy|SV-77239

STIG-Legacy|V-62749

Vuln-ID|V-228661

PANW-NM-000097 - The Palo Alto Networks security platform must have alarms enabled.

CCI|CCI-001858

Rule-ID|SV-228662r513591_rule

STIG-ID|PANW-NM-000097

STIG-Legacy|SV-77241

STIG-Legacy|V-62751

Vuln-ID|V-228662

PANW-NM-000098 - The Palo Alto Networks security platform must compare internal information system clocks at least every 24 hours with an authoritative time server.

CCI|CCI-001891

Rule-ID|SV-228663r513594_rule

STIG-ID|PANW-NM-000098

STIG-Legacy|SV-77243

STIG-Legacy|V-62753

Vuln-ID|V-228663

PANW-NM-000099 - The Palo Alto Networks security platform must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.

CCI|CCI-002046

Rule-ID|SV-228664r513597_rule

STIG-ID|PANW-NM-000099

STIG-Legacy|SV-77245

STIG-Legacy|V-62755

Vuln-ID|V-228664

PANW-NM-000100 - The Palo Alto Networks security platform must be configured to synchronize internal information system clocks with the primary and secondary time sources located in different geographic regions using redundant authoritative time sources.

CCI|CCI-001893

Rule-ID|SV-228665r513600_rule

STIG-ID|PANW-NM-000100

STIG-Legacy|SV-77247

STIG-Legacy|V-62757

Vuln-ID|V-228665

PANW-NM-000101 - The Palo Alto Networks security platform must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

CCI|CCI-001890

Rule-ID|SV-228666r513603_rule

STIG-ID|PANW-NM-000101

STIG-Legacy|SV-77249

STIG-Legacy|V-62759

Vuln-ID|V-228666

PANW-NM-000110 - The Palo Alto Networks security platform must accept and verify Personal Identity Verification (PIV) credentials - 'Certificate Profile'

CCI|CCI-001953

Rule-ID|SV-228667r513606_rule

STIG-ID|PANW-NM-000110

STIG-Legacy|SV-77251

STIG-Legacy|V-62761

Vuln-ID|V-228667

PANW-NM-000110 - The Palo Alto Networks security platform must accept and verify Personal Identity Verification (PIV) credentials - 'DOD CA certificates'

PANW-NM-000110 - The Palo Alto Networks security platform must accept and verify Personal Identity Verification (PIV) credentials - 'Use OCSP'

PANW-NM-000114 - The Palo Alto Networks security platform must allow the use of a temporary password for system logons with an immediate change to a permanent password.

CCI|CCI-002041

Rule-ID|SV-228668r513609_rule

STIG-ID|PANW-NM-000114

STIG-Legacy|SV-77253

STIG-Legacy|V-62763

Vuln-ID|V-228668

PANW-NM-000117 - The Palo Alto Networks security platform must only allow the use of secure protocols that implement cryptographic mechanisms to protect the integrity of maintenance and diagnostic communications for nonlocal maintenance sessions.

CCI|CCI-002890

Rule-ID|SV-228669r513612_rule

STIG-ID|PANW-NM-000117

STIG-Legacy|SV-77255

STIG-Legacy|V-62765

Vuln-ID|V-228669

PANW-NM-000118 - The Palo Alto Networks security platform must not use SNMP Versions 1 or 2 - 'SNMP Trap v3'

CCI|CCI-003123

Rule-ID|SV-228670r513615_rule

Detections

Analytics

Revision 1.2

Oct 18, 2022

Functional Update