PANW-NM-000015 - The Palo Alto Networks security platform must enforce the limit of three consecutive invalid logon attempts.

CAT|II

CCI|CCI-000044

Rule-ID|SV-228639r960840_rule

STIG-ID|PANW-NM-000015

STIG-Legacy|SV-77195

STIG-Legacy|V-62705

Vuln-ID|V-228639

PANW-NM-000016 - The Palo Alto Networks security platform must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

CAT|III

CCI|CCI-000048

Rule-ID|SV-228640r960843_rule

STIG-ID|PANW-NM-000016

STIG-Legacy|SV-77197

STIG-Legacy|V-62707

Vuln-ID|V-228640

PANW-NM-000024 - The Palo Alto Networks security platform must generate audit records when successful/unsuccessful attempts to access privileges occur

CCI|CCI-000172

Rule-ID|SV-228642r960885_rule

STIG-ID|PANW-NM-000024

STIG-Legacy|SV-77201

STIG-Legacy|V-62711

Vuln-ID|V-228642

PANW-NM-000029 - The Palo Alto Networks security platform must produce audit log records containing information (FQDN, unique hostname, management IP address) to establish the source of events

CCI|CCI-000133

Rule-ID|SV-228643r960900_rule

STIG-ID|PANW-NM-000029

STIG-Legacy|SV-77203

STIG-Legacy|V-62713

Vuln-ID|V-228643

PANW-NM-000046 - The Palo Alto Networks security platform must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

CCI|CCI-000382

Rule-ID|SV-228645r960966_rule

STIG-ID|PANW-NM-000046

STIG-Legacy|SV-77207

STIG-Legacy|V-62717

Vuln-ID|V-228645

PANW-NM-000047 - The Palo Alto Networks security platform must uniquely identify and authenticate organizational administrators (or processes acting on behalf of organizational administrators).

CCI|CCI-000366

CCI|CCI-000764

Rule-ID|SV-228646r961863_rule

STIG-ID|PANW-NM-000047

STIG-Legacy|SV-77209

STIG-Legacy|V-62719

Vuln-ID|V-228646

PANW-NM-000048 - The Palo Alto device must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.

CCI|CCI-001358

CCI|CCI-002111

Rule-ID|SV-268323r1018733_rule

STIG-ID|PANW-NM-000048

Vuln-ID|V-268323

PANW-NM-000051 - The Palo Alto Networks security platform must implement replay-resistant authentication mechanisms for network access to privileged accounts.

CCI|CCI-001941

Rule-ID|SV-228647r960993_rule

STIG-ID|PANW-NM-000051

STIG-Legacy|SV-77211

STIG-Legacy|V-62721

Vuln-ID|V-228647

PANW-NM-000053 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce a minimum 15-character password length.

CCI|CCI-000205

CCI|CCI-004066

Rule-ID|SV-228648r1018774_rule

STIG-ID|PANW-NM-000053

STIG-Legacy|SV-77213

STIG-Legacy|V-62723

Vuln-ID|V-228648

PANW-NM-000055 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce password complexity by requiring that at least one uppercase character be used.

CCI|CCI-000192

Rule-ID|SV-228650r1018775_rule

STIG-ID|PANW-NM-000055

STIG-Legacy|SV-77217

STIG-Legacy|V-62727

Vuln-ID|V-228650

PANW-NM-000056 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce password complexity by requiring that at least one lowercase character be used.

CCI|CCI-000193

Rule-ID|SV-228651r1018776_rule

STIG-ID|PANW-NM-000056

STIG-Legacy|SV-77219

STIG-Legacy|V-62729

Vuln-ID|V-228651

PANW-NM-000057 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce password complexity by requiring that at least one numeric character be used.

CCI|CCI-000194

Rule-ID|SV-228652r1018777_rule

STIG-ID|PANW-NM-000057

STIG-Legacy|SV-77221

STIG-Legacy|V-62731

Vuln-ID|V-228652

PANW-NM-000058 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must enforce password complexity by requiring that at least one special character be used.

CCI|CCI-001619

Rule-ID|SV-228653r1018778_rule

STIG-ID|PANW-NM-000058

STIG-Legacy|SV-77223

STIG-Legacy|V-62733

Vuln-ID|V-228653

PANW-NM-000059 - If multifactor authentication is not available and passwords must be used, the Palo Alto Networks security platform must require that when a password is changed, the characters are changed in at least 8 of the positions within the password.

CCI|CCI-000195

Rule-ID|SV-228654r1018779_rule

STIG-ID|PANW-NM-000059

STIG-Legacy|SV-77225

STIG-Legacy|V-62735

Vuln-ID|V-228654

PANW-NM-000061 - The Palo Alto Networks security platform must prohibit the use of unencrypted protocols for network access to privileged accounts.

CCI|CCI-000197

Rule-ID|SV-228655r961029_rule

STIG-ID|PANW-NM-000061

STIG-Legacy|SV-77227

STIG-Legacy|V-62737

Vuln-ID|V-228655

PANW-NM-000069 - The Palo Alto Networks security platform must terminate management sessions after 10 minutes of inactivity except to fulfill documented and validated mission requirements.

CAT|I

CCI|CCI-001133

Rule-ID|SV-228658r961068_rule

STIG-ID|PANW-NM-000069

STIG-Legacy|SV-77233

STIG-Legacy|V-62743

Vuln-ID|V-228658

PANW-NM-000075 - Administrators in the role of Security Administrator,  Cryptographic Administrator, or Audit Administrator must not also have the role of Audit Administrator.

CCI|CCI-001314

Rule-ID|SV-228659r961863_rule

STIG-ID|PANW-NM-000075

STIG-Legacy|SV-77235

STIG-Legacy|V-62745

Vuln-ID|V-228659

PANW-NM-000092 - The Palo Alto Networks security platform must automatically lock the account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are exceeded.

CCI|CCI-002238

Rule-ID|SV-228660r961863_rule

STIG-ID|PANW-NM-000092

STIG-Legacy|SV-77237

STIG-Legacy|V-62747

Vuln-ID|V-228660

PANW-NM-000096 - The Palo Alto Networks security platform must generate an immediate alert when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.

CCI|CCI-001855

Rule-ID|SV-228661r961863_rule

STIG-ID|PANW-NM-000096

STIG-Legacy|SV-77239

STIG-Legacy|V-62749

Vuln-ID|V-228661

PANW-NM-000097 - The Palo Alto Networks security platform must have alarms enabled.

CCI|CCI-001858

CCI|CCI-003831

Rule-ID|SV-228662r997675_rule

STIG-ID|PANW-NM-000097

STIG-Legacy|SV-77241

STIG-Legacy|V-62751

Vuln-ID|V-228662

PANW-NM-000098 - The Palo Alto Networks security platform must compare internal information system clocks at least every 24 hours with an authoritative time server.

CCI|CCI-001891

CCI|CCI-004923

Rule-ID|SV-228663r1018780_rule

STIG-ID|PANW-NM-000098

STIG-Legacy|SV-77243

STIG-Legacy|V-62753

Vuln-ID|V-228663

PANW-NM-000099 - The Palo Alto Networks security platform must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.

CCI|CCI-002046

CCI|CCI-004926

Rule-ID|SV-228664r1018781_rule

STIG-ID|PANW-NM-000099

STIG-Legacy|SV-77245

STIG-Legacy|V-62755

Vuln-ID|V-228664

PANW-NM-000100 - The Palo Alto Networks security platform must be configured to synchronize internal information system clocks with the primary and secondary time sources located in different geographic regions using redundant authoritative time sources.

CCI|CCI-001893

CCI|CCI-004922

CCI|CCI-004928

Rule-ID|SV-228665r1018782_rule

STIG-ID|PANW-NM-000100

STIG-Legacy|SV-77247

STIG-Legacy|V-62757

Vuln-ID|V-228665

PANW-NM-000101 - The Palo Alto Networks security platform must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

CCI|CCI-001890

Rule-ID|SV-228666r961443_rule

STIG-ID|PANW-NM-000101

STIG-Legacy|SV-77249

STIG-Legacy|V-62759

Vuln-ID|V-228666

PANW-NM-000110 - The Palo Alto Networks security platform must accept and verify Personal Identity Verification (PIV) credentials

CCI|CCI-001953

CCI|CCI-004068

Rule-ID|SV-228667r997687_rule

STIG-ID|PANW-NM-000110

STIG-Legacy|SV-77251

STIG-Legacy|V-62761

Vuln-ID|V-228667

PANW-NM-000117 - The Palo Alto Networks security platform must only allow the use of secure protocols that implement cryptographic mechanisms to protect the integrity of maintenance and diagnostic communications for nonlocal maintenance sessions.

CCI|CCI-002890

Rule-ID|SV-228669r961554_rule

STIG-ID|PANW-NM-000117

STIG-Legacy|SV-77255

STIG-Legacy|V-62765

Vuln-ID|V-228669

PANW-NM-000118 - The Palo Alto Networks security platform must not use SNMP Versions 1 or 2

CCI|CCI-003123

Rule-ID|SV-228670r961557_rule

STIG-ID|PANW-NM-000118

STIG-Legacy|SV-77257

STIG-Legacy|V-62767

Vuln-ID|V-228670

PANW-NM-000128 - The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited

CCI|CCI-001851

Detections

Analytics

Revision 1.1Apr 21, 2025

Functional Update

Miscellaneous