PANW-IP-000001 - The Palo Alto Networks security platform must enable Antivirus, Anti-spyware, and Vulnerability Protection for all authorized traffic.

800-53|AC-4

CAT|II

CCI|CCI-001368

Rule-ID|SV-207688r557390_rule

STIG-ID|PANW-IP-000001

STIG-Legacy|SV-77137

STIG-Legacy|V-62647

Vuln-ID|V-207688

PANW-IP-000007 - The Palo Alto Networks security platform must produce audit records containing information to establish the source of the event, including, at a minimum, originating source address.

800-53|AU-3

CCI|CCI-000133

Rule-ID|SV-207689r767016_rule

STIG-ID|PANW-IP-000007

STIG-Legacy|SV-77139

STIG-Legacy|V-62649

Vuln-ID|V-207689

PANW-IP-000008 - The Palo Alto Networks security platform must capture traffic of detected/dropped malicious code.

CCI|CCI-000134

Rule-ID|SV-207690r559743_rule

STIG-ID|PANW-IP-000008

STIG-Legacy|SV-77141

STIG-Legacy|V-62651

Vuln-ID|V-207690

PANW-IP-000010 - In the event of a logging failure caused by the lack of audit record storage capacity, the Palo Alto Networks security platform must continue generating and storing audit records if possible, overwriting the oldest audit records in a first-in-first-out manner.

800-53|AU-5b.

CCI|CCI-000140

Rule-ID|SV-207691r1038960_rule

STIG-ID|PANW-IP-000010

STIG-Legacy|SV-77143

STIG-Legacy|V-62653

Vuln-ID|V-207691

PANW-IP-000018 - The Palo Alto Networks security platform must have a denial-of-service (DoS) Protection Profile for outbound traffic applied to a policy for traffic originating from the internal zone going to the external zone.

800-53|SC-5(2)

CCI|CCI-001095

CCI|CCI-004866

Rule-ID|SV-207692r997604_rule

STIG-ID|PANW-IP-000018

STIG-Legacy|SV-77145

STIG-Legacy|V-62655

Vuln-ID|V-207692

PANW-IP-000020 - The Palo Alto Networks security platform must detect and deny any prohibited mobile or otherwise malicious code at the enclave boundary.

800-53|SC-18(1)

CCI|CCI-001662

Rule-ID|SV-207693r768712_rule

STIG-ID|PANW-IP-000020

STIG-Legacy|SV-77147

STIG-Legacy|V-62657

Vuln-ID|V-207693

PANW-IP-000024 - The Palo Alto Networks security platform must install updates for application software files, signature definitions, detection heuristics, and vendor-provided rules when new releases are available in accordance with organizational configuration management policy and procedures.

800-53|SI-3b.

CCI|CCI-004965

Rule-ID|SV-207694r997607_rule

STIG-ID|PANW-IP-000024

STIG-Legacy|SV-77149

STIG-Legacy|V-62659

Vuln-ID|V-207694

PANW-IP-000026 - The Palo Alto Networks security platform must detect and drop any prohibited mobile or otherwise malicious code at internal boundaries.

800-53|SI-3c.2.

CCI|CCI-001243

Rule-ID|SV-207695r557390_rule

STIG-ID|PANW-IP-000026

STIG-Legacy|SV-77151

STIG-Legacy|V-62661

Vuln-ID|V-207695

PANW-IP-000028 - The Palo Alto Networks security platform must send an immediate (within seconds) alert to, at a minimum, the SA when malicious code is detected.

Rule-ID|SV-207696r557390_rule

STIG-ID|PANW-IP-000028

STIG-Legacy|SV-77153

STIG-Legacy|V-62663

Vuln-ID|V-207696

PANW-IP-000029 - The Palo Alto Networks security platform must automatically install updates to signature definitions, detection heuristics, and vendor-provided rules.

CCI|CCI-004964

Rule-ID|SV-207697r997610_rule

STIG-ID|PANW-IP-000029

STIG-Legacy|SV-77155

STIG-Legacy|V-62665

Vuln-ID|V-207697

PANW-IP-000030 - The Palo Alto Networks security platform must block outbound ICMP Destination Unreachable, Redirect, and Address Mask reply messages.

800-53|SI-11a.

CCI|CCI-001312

Rule-ID|SV-207698r1056118_rule

STIG-ID|PANW-IP-000030

STIG-Legacy|SV-77157

STIG-Legacy|V-62667

Vuln-ID|V-207698

PANW-IP-000031 - The Palo Alto Networks security platform must block malicious ICMP packets.

Rule-ID|SV-207699r557390_rule

STIG-ID|PANW-IP-000031

STIG-Legacy|SV-77159

STIG-Legacy|V-62669

Vuln-ID|V-207699

PANW-IP-000032 - To protect against unauthorized data mining, the Palo Alto Networks security platform must detect and prevent SQL and other code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

800-53|AC-23

CCI|CCI-002346

Rule-ID|SV-207700r856614_rule

STIG-ID|PANW-IP-000032

STIG-Legacy|SV-77161

STIG-Legacy|V-62671

Vuln-ID|V-207700

PANW-IP-000033 - To protect against unauthorized data mining, the Palo Alto Networks security platform must detect and prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

Rule-ID|SV-207701r1056120_rule

STIG-ID|PANW-IP-000033

STIG-Legacy|SV-77163

STIG-Legacy|V-62673

Vuln-ID|V-207701

PANW-IP-000039 - The Palo Alto Networks security platform must off-load log records to a centralized log server.

800-53|AU-4(1)

CAT|III

CCI|CCI-001851

Rule-ID|SV-207702r856616_rule

STIG-ID|PANW-IP-000039

STIG-Legacy|SV-77165

STIG-Legacy|V-62675

Vuln-ID|V-207702

PANW-IP-000041 - The Palo Alto Networks security platform must protect against or limit the effects of known and unknown types of denial-of-service (DoS) attacks by employing rate-based attack prevention behavior analysis (traffic thresholds) - traffic thresholds

800-53|SC-5

CCI|CCI-002385

Rule-ID|SV-207703r997613_rule

STIG-ID|PANW-IP-000041

STIG-Legacy|SV-77167

STIG-Legacy|V-62677

Vuln-ID|V-207703

PANW-IP-000043 - The Palo Alto Networks security platform must use a Vulnerability Protection Profile that blocks any critical, high, or medium threats.

Rule-ID|SV-207704r997616_rule

STIG-ID|PANW-IP-000043

STIG-Legacy|SV-77169

STIG-Legacy|V-62679

Vuln-ID|V-207704

PANW-IP-000045 - Palo Alto Networks security platform components, including sensors, event databases, and management consoles must integrate with a network-wide monitoring capability.

800-53|SI-4(1)

CCI|CCI-002656

Rule-ID|SV-207705r856619_rule

STIG-ID|PANW-IP-000045

STIG-Legacy|SV-77171

STIG-Legacy|V-62681

Vuln-ID|V-207705

PANW-IP-000046 - The Palo Alto Networks security platform must detect use of network services that have not been authorized or approved by the ISSM and ISSO, at a minimum.

800-53|SI-4(22)

CCI|CCI-002683

Rule-ID|SV-207706r856620_rule

STIG-ID|PANW-IP-000046

STIG-Legacy|SV-77173

STIG-Legacy|V-62683

Vuln-ID|V-207706

PANW-IP-000047 - The Palo Alto Networks security platform must generate a log record when unauthorized network services are detected.

CCI|CCI-002684

Rule-ID|SV-207707r856621_rule

STIG-ID|PANW-IP-000047

STIG-Legacy|SV-77175

STIG-Legacy|V-62685

Vuln-ID|V-207707

PANW-IP-000048 - The Palo Alto Networks security platform must generate an alert to the ISSO and ISSM, at a minimum, when unauthorized network services are detected.

Rule-ID|SV-207708r856622_rule

STIG-ID|PANW-IP-000048

STIG-Legacy|SV-77177

STIG-Legacy|V-62687

Vuln-ID|V-207708

PANW-IP-000049 - The Palo Alto Networks security platform must continuously monitor inbound communications traffic for unusual/unauthorized activities or conditions.

800-53|SI-4(4)

CCI|CCI-002661

Rule-ID|SV-207709r856623_rule

STIG-ID|PANW-IP-000049

STIG-Legacy|SV-77179

STIG-Legacy|V-62689

Vuln-ID|V-207709

PANW-IP-000050 - The Palo Alto Networks security platform must continuously monitor outbound communications traffic for unusual/unauthorized activities or conditions.

CCI|CCI-002662

Rule-ID|SV-207710r856624_rule

STIG-ID|PANW-IP-000050

STIG-Legacy|SV-77181

STIG-Legacy|V-62691

Vuln-ID|V-207710

PANW-IP-000051 - The Palo Alto Networks security platform must send an alert to, at a minimum, the ISSO and ISSM when intrusion detection events are detected which indicate a compromise or potential for compromise.

800-53|SI-4(5)

CCI|CCI-002664

Rule-ID|SV-207711r971533_rule

STIG-ID|PANW-IP-000051

STIG-Legacy|SV-77183

STIG-Legacy|V-62693

Vuln-ID|V-207711

PANW-IP-000052 - The Palo Alto Networks security platform must send an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected.

Rule-ID|SV-207712r971533_rule

STIG-ID|PANW-IP-000052

STIG-Legacy|SV-77185

STIG-Legacy|V-62695

Vuln-ID|V-207712

PANW-IP-000053 - The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when rootkits or other malicious software which allows unauthorized privileged or non-privileged access is detected.

Rule-ID|SV-207713r971533_rule

STIG-ID|PANW-IP-000053

STIG-Legacy|SV-77187

STIG-Legacy|V-62697

Vuln-ID|V-207713

PANW-IP-000055 - The Palo Alto Networks security platform must send an alert to, at a minimum, the ISSO and ISSM when denial of service incidents are detected.

Rule-ID|SV-207714r971533_rule

STIG-ID|PANW-IP-000055

STIG-Legacy|SV-77189

STIG-Legacy|V-62699

Vuln-ID|V-207714

PANW-IP-000056 - The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when new active propagation of malware infecting DoD systems or malicious code adversely affecting the operations and/or security of DoD systems is detected.

Rule-ID|SV-207715r971533_rule

Detections

Analytics

DISA Palo Alto Networks IDPS STIG v3r2

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Sep 1, 2026 Miscellaneous Metadata updated. See also link updated.
Revision 1.1 Feb 13, 2026 Miscellaneous Metadata updated.

Detections

Analytics

DISA Palo Alto Networks IDPS STIG v3r2 Download File

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA Palo Alto Networks IDPS STIG v3r2