PANW-AG-000015 - The Palo Alto Networks security platform, if used to provide intermediary services for remote access communications traffic (TLS or SSL decryption), must ensure inbound and outbound traffic is monitored for compliance with remote access security policies - TLS/SSL must monitor traffic.

800-53|CM-6

800-53|SC-7(17)

CAT|II

CCI|CCI-000067

Group-ID|V-62547

Rule-ID|SV-228832r557387_rule

STIG-ID|PANW-AG-000015

STIG-Legacy|SV-77037

STIG-Legacy|V-62547

Vuln-ID|V-228832

PANW-AG-000016 - The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.

800-53|SC-13

CCI|CCI-000068

Group-ID|V-62549

Rule-ID|SV-228833r557387_rule

STIG-ID|PANW-AG-000016

STIG-Legacy|SV-77039

STIG-Legacy|V-62549

Vuln-ID|V-228833

PANW-AG-000017 - The Palo Alto Networks security platform that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.

Group-ID|V-62551

Rule-ID|SV-228834r557387_rule

STIG-ID|PANW-AG-000017

STIG-Legacy|SV-77041

STIG-Legacy|V-62551

Vuln-ID|V-228834

PANW-AG-000020 - The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.

CCI|CCI-001453

Group-ID|V-62553

Rule-ID|SV-228835r557387_rule

STIG-ID|PANW-AG-000020

STIG-Legacy|SV-77043

STIG-Legacy|V-62553

Vuln-ID|V-228835

PANW-AG-000024 - The Palo Alto Networks security platform must log violations of security policies.

800-53|AU-12

CAT|III

CCI|CCI-000133

Group-ID|V-62555

Rule-ID|SV-228836r557387_rule

STIG-ID|PANW-AG-000024

STIG-Legacy|SV-77045

STIG-Legacy|V-62555

Vuln-ID|V-228836

PANW-AG-000035 - The Palo Alto Networks security platform must only enable User-ID on trusted zones.

CCI|CCI-000381

CSCv6|3.1

Group-ID|V-62557

Rule-ID|SV-228837r557387_rule

STIG-ID|PANW-AG-000035

STIG-Legacy|SV-77047

STIG-Legacy|V-62557

Vuln-ID|V-228837

PANW-AG-000036 - The Palo Alto Networks security platform must disable WMI probing if it is not used.

800-53|CM-7

CSCv6|9.1

Group-ID|V-62559

Rule-ID|SV-228838r557387_rule

STIG-ID|PANW-AG-000036

STIG-Legacy|SV-77049

STIG-Legacy|V-62559

Vuln-ID|V-228838

PANW-AG-000037 - The Palo Alto Networks security platform must not enable the DNS proxy.

Group-ID|V-62561

Rule-ID|SV-228839r557387_rule

STIG-ID|PANW-AG-000037

STIG-Legacy|SV-77051

STIG-Legacy|V-62561

Vuln-ID|V-228839

PANW-AG-000038 - The Palo Alto Networks security platform must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

CCI|CCI-000382

Group-ID|V-62563

Rule-ID|SV-228840r557387_rule

STIG-ID|PANW-AG-000038

STIG-Legacy|SV-77053

STIG-Legacy|V-62563

Vuln-ID|V-228840

PANW-AG-000044 - The Palo Alto Networks security platform that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.

800-53|IA-5(2)

CCI|CCI-000185

Group-ID|V-62565

Rule-ID|SV-228841r557387_rule

STIG-ID|PANW-AG-000044

STIG-Legacy|SV-77055

STIG-Legacy|V-62565

Vuln-ID|V-228841

PANW-AG-000047 - The Palo Alto Networks security platform must protect against the use of internal systems from launching Denial of Service (DoS) attacks against other networks or endpoints.

800-53|SC-5

CCI|CCI-001094

Group-ID|V-62567

Rule-ID|SV-228842r557387_rule

STIG-ID|PANW-AG-000047

STIG-Legacy|SV-77057

STIG-Legacy|V-62567

Vuln-ID|V-228842

PANW-AG-000049 - The Palo Alto Networks security platform must block phone home traffic.

Group-ID|V-62569

Rule-ID|SV-228843r557387_rule

STIG-ID|PANW-AG-000049

STIG-Legacy|SV-77059

STIG-Legacy|V-62569

Vuln-ID|V-228843

PANW-AG-000050 - The Palo Alto Networks security platform must deny outbound IP packets that contain an illegitimate address in the source address field.

800-53|SC-5(1)

Group-ID|V-62571

Rule-ID|SV-228844r557387_rule

STIG-ID|PANW-AG-000050

STIG-Legacy|SV-77061

STIG-Legacy|V-62571

Vuln-ID|V-228844

PANW-AG-000051 - The Palo Alto Networks security platform must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

800-53|SC-7(5)

CCI|CCI-001109

Group-ID|V-62573

Rule-ID|SV-228845r557387_rule

STIG-ID|PANW-AG-000051

STIG-Legacy|SV-77063

STIG-Legacy|V-62573

Vuln-ID|V-228845

PANW-AG-000052 - The Palo Alto Networks security platform must terminate communications sessions after 15 minutes of inactivity.

800-53|AC-12

CCI|CCI-001133

CSCv6|16.4

Group-ID|V-62575

Rule-ID|SV-228846r557387_rule

STIG-ID|PANW-AG-000052

STIG-Legacy|SV-77065

STIG-Legacy|V-62575

Vuln-ID|V-228846

PANW-AG-000060 - The Palo Alto Networks security platform must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.

CCI|CCI-001240

Group-ID|V-62577

Rule-ID|SV-228847r557387_rule

STIG-ID|PANW-AG-000060

STIG-Legacy|SV-77067

STIG-Legacy|V-62577

Vuln-ID|V-228847

PANW-AG-000062 - The Palo Alto Networks security platform must drop malicious code upon detection - Antivirus Profiles.

800-53|SI-3

CCI|CCI-001243

Group-ID|V-62579

Rule-ID|SV-228848r559740_rule

STIG-ID|PANW-AG-000062

STIG-Legacy|SV-77069

STIG-Legacy|V-62579

Vuln-ID|V-228848

PANW-AG-000062 - The Palo Alto Networks security platform must drop malicious code upon detection - Antivirus Services.

PANW-AG-000063 - The Palo Alto Networks security platform must delete or quarantine malicious code in response to malicious code detection - Antivirus Profiles

Group-ID|V-62581

Rule-ID|SV-228849r559739_rule

STIG-ID|PANW-AG-000063

STIG-Legacy|SV-77071

STIG-Legacy|V-62581

Vuln-ID|V-228849

PANW-AG-000063 - The Palo Alto Networks security platform must delete or quarantine malicious code in response to malicious code detection - Antivirus Services

PANW-AG-000064 - The Palo Alto Networks security platform must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection - Email Log Forwarding

800-53|SI-4(5)

Group-ID|V-62645

Rule-ID|SV-228850r557387_rule

STIG-ID|PANW-AG-000064

STIG-Legacy|SV-77135

STIG-Legacy|V-62645

Vuln-ID|V-228850

PANW-AG-000064 - The Palo Alto Networks security platform must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection - Email Servers

PANW-AG-000065 - The Palo Alto Networks security platform must automatically update malicious code protection mechanisms - Download Action

800-53|SI-3(2)

CCI|CCI-001247

Group-ID|V-62583

Rule-ID|SV-228851r557387_rule

STIG-ID|PANW-AG-000065

STIG-Legacy|SV-77073

STIG-Legacy|V-62583

Vuln-ID|V-228851

PANW-AG-000065 - The Palo Alto Networks security platform must automatically update malicious code protection mechanisms - Schedule

PANW-AG-000073 - The Palo Alto Networks security platform must deny or restrict detected prohibited mobile code - Antivirus Actions

CCI|CCI-001695

Group-ID|V-62585

Rule-ID|SV-228852r559734_rule

STIG-ID|PANW-AG-000073

STIG-Legacy|SV-77075

STIG-Legacy|V-62585

Vuln-ID|V-228852

PANW-AG-000073 - The Palo Alto Networks security platform must deny or restrict detected prohibited mobile code - Antivirus Policies

PANW-AG-000074 - The Palo Alto Networks security platform must prevent the download of prohibited mobile code - Antivirus Profiles

CCI|CCI-001169

Group-ID|V-62587

Rule-ID|SV-228853r559712_rule

STIG-ID|PANW-AG-000074

STIG-Legacy|SV-77077

STIG-Legacy|V-62587

Vuln-ID|V-228853

PANW-AG-000074 - The Palo Alto Networks security platform must prevent the download of prohibited mobile code - Antivirus Protocols

PANW-AG-000078 - The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must control remote access methods (inspect and filter traffic).

Detections

Analytics

DISA STIG Palo Alto ALG v2r1

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.4

Functional Update

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Functional Update

Miscellaneous