Palo Alto Best Practice Assessment (BPA) for Security Profiles

Objective

This guide explains how to configure Palo Alto Networks Security Profiles in accordance with the Best Practice Assessment (BPA) recommendations.

Running the BPA regularly helps ensure your firewall configuration adheres to security best practices, reducing your attack surface. You can run the BPA directly from Strata Cloud Manager (formerly AIOps for NGFW).

• For devices not associated with AIOps: On Demand BPA Report
• For devices associated with AIOps: AIOps Best Practices

BPA results often highlight Security Profiles that fail checks if not configured according to best practices. This document provides configuration examples and screenshots to simplify adherence.

Refer to the official documentation for comprehensive details: Security Policy Best Practices .

Flowchart illustrating how Security Profiles integrate with Security Policy rules.

Security Profiles Overview

While Security policy rules enable you to allow or block traffic on your network, Security Profiles help you define an allow but scan rule. This scans allowed applications for threats, such as viruses, malware, spyware, and DDoS attacks. When traffic matches the allow rule defined in the Security policy rule, the Security Profile(s) attached to the rule are applied for further content inspection.

Security Profiles are not used in the match criteria of a traffic flow. They are applied after the application or category is allowed by the Security policy rule.

The firewall provides default Security Profiles that you can use out of the box. However, for optimal protection aligned with best practices, creating custom profiles is recommended.

• See Set Up a Basic Security Policy for using default profiles.
• See Create Best Practice Security Profiles for the Internet Gateway for creating custom profiles based on BPA.

You can bundle commonly used profiles into Security Profile Groups for easier application to policies.

Common Security Profile Types

The following sections detail the configuration recommendations for core Security Profiles based on BPA.

Antivirus Profile (BPA Recommended)

Antivirus profiles protect against viruses, worms, trojans, and spyware downloads. Palo Alto Networks recommends specific settings for optimal protection.

The default action uses the action specified by Palo Alto Networks for that specific signature, typically 'alert' or 'reset-both'.

Actions available include:

• Default: Uses Palo Alto Networks predefined action.
• Allow: Permits traffic (no logs generated for this threat).
• Alert: Generates a threat log entry.
• Drop: Drops the offending packet/connection silently.
• Reset Client: Sends TCP RST to the client.
• Reset Server: Sends TCP RST to the server.
• Reset Both: Sends TCP RST to both client and server.

Anti-Spyware Profile (BPA Recommended)

Anti-Spyware profiles block spyware C2 communications and detect malicious traffic leaving the network.

The Strict profile overrides the default action to 'block' for critical, high, and medium threats, while using the default action for low and informational.

Actions are similar to Antivirus, with the addition of:

• DNS Sinkhole: Forges a DNS response for malicious domains, redirecting the client to a specified sinkhole IP.
• Block IP: Blocks the source IP (or source/destination pair) for a configurable duration.

Vulnerability Protection Profile (BPA Recommended)

Vulnerability Protection profiles stop attempts to exploit system flaws entering the network.

Actions are the same as for Anti-Spyware profiles (excluding DNS Sinkhole).

URL Filtering Profile (BPA Recommended)

URL Filtering profiles monitor and control web access based on URL categories.

Comprehensive Category Actions (CLI format example)

This shows the typical BPA recommendations in CLI format. Adjust according to your organization's policy.

set profiles url-filtering BPA-URL alert [ abortion alcohol-and-tobacco artificial-intelligence auctions business-and-economy computer-and-internet-info content-delivery-networks cryptocurrency dating educational-institutions entertainment-and-arts financial-services games government health-and-medicine high-risk home-and-garden hunting-and-fishing internet-communications-and-telephony internet-portals job-search legal low-risk marijuana medium-risk military motor-vehicles music news nudity online-storage-and-backup personal-sites-and-blogs philosophy-and-political-advocacy private-ip-addresses real-estate real-time-detection recreation-and-hobbies reference-and-research religion search-engines sex-education shareware-and-freeware shopping social-networking society sports stock-advice-and-tools streaming-media swimsuits-and-intimate-apparel training-and-tools translation travel web-advertisements web-based-email web-hosting ]

set profiles url-filtering BPA-URL block [ abused-drugs adult command-and-control copyright-infringement dynamic-dns encrypted-dns extremism gambling grayware hacking insufficient-content malware newly-registered-domain not-resolved parked peer-to-peer phishing proxy-avoidance-and-anonymizers questionable ransomware scanning-activity unknown weapons ]

set profiles url-filtering BPA-URL credential-enforcement alert [ abortion alcohol-and-tobacco artificial-intelligence auctions business-and-economy computer-and-internet-info content-delivery-networks cryptocurrency dating educational-institutions entertainment-and-arts financial-services games government health-and-medicine home-and-garden hunting-and-fishing internet-communications-and-telephony internet-portals job-search legal low-risk marijuana medium-risk military motor-vehicles music news nudity online-storage-and-backup personal-sites-and-blogs philosophy-and-political-advocacy private-ip-addresses real-estate real-time-detection recreation-and-hobbies reference-and-research religion search-engines sex-education shareware-and-freeware shopping social-networking society sports stock-advice-and-tools streaming-media swimsuits-and-intimate-apparel training-and-tools translation travel web-advertisements web-based-email web-hosting ]

set profiles url-filtering BPA-URL credential-enforcement block [ abused-drugs adult command-and-control copyright-infringement dynamic-dns encrypted-dns extremism gambling grayware hacking high-risk insufficient-content malware newly-registered-domain not-resolved parked peer-to-peer phishing proxy-avoidance-and-anonymizers questionable ransomware scanning-activity unknown weapons ]
            

File Blocking Profiles

File blocking profiles prevent specific file types from being uploaded or downloaded based on application and direction.

To get started, see Set Up File Blocking .

WildFire Analysis Profiles

WildFire Analysis profiles control which unknown files or email links are forwarded to the WildFire cloud or a local WF-500 appliance for analysis to detect zero-day threats.

Apply WildFire Analysis profiles within Security Profile Groups or directly to Security Policy rules.

See Forward Files for WildFire Analysis for configuration details.

DoS Protection Profiles

DoS Protection profiles configure thresholds and actions for Denial of Service (DoS) attacks, applied via DoS Protection policy rules (not Security Policy rules).

DoS thresholds require careful tuning based on legitimate traffic baselines to avoid blocking valid users.

See DoS Protection Against Flooding for details.

Zone Protection Profiles

Zone Protection Profiles apply network-level defenses to entire zones, protecting the firewall and zone infrastructure itself from reconnaissance and packet-based attacks.

Incorrectly configured Zone Protection thresholds can easily disrupt legitimate traffic.

See Zone Protection Profiles for configuration details.

Security Profile Groups

A Security Profile Group bundles multiple Security Profiles (Antivirus, Anti-Spyware, URL Filtering, etc.) into a single unit that can be easily applied to Security policy rules.

Creating a Security Profile Group

1. Navigate to Objects > Security Profile Groups .
2. Click Add .
3. Provide a descriptive Name (e.g., "Standard-Web-Access", "Strict-Server-Protection").
4. (Multi-VSYS/Panorama) Choose if it should be Shared .
5. Add the desired Security Profiles from the dropdown lists (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, etc.).
6. Click OK .

Applying a Security Profile Group

1. Edit or create a Security Policy rule ( Policies > Security ).
2. Go to the Actions tab.
3. Set Profile Setting > Profile Type to Group .
4. Select your created group from the Group Profile dropdown.

Click OK and Commit the changes.

Default Security Profile Group

You can designate one Security Profile Group to be the default group. This group will automatically be applied to any new Security policy rules you create, ensuring a baseline level of protection is always included.

Now, when you add a new Security policy rule, the 'Actions' tab will automatically have the 'Profile Type' set to 'Group' and the 'Group Profile' set to 'default'.

Overriding the Default

Even if a default group is set, you can always change the profile settings for any specific rule. Simply go to the rule's Actions tab and either select a different Group Profile or change the Profile Type to 'Profiles' to select individual Security Profiles.

Data Filtering Overview

Data Filtering profiles help prevent sensitive, confidential, or proprietary information from leaving your network. This is a key component of Data Loss Prevention (DLP).

Setting up Data Filtering typically involves:

1. Creating Data Pattern Objects ( Objects > Custom Objects > Data Patterns ) to define what to look for (using predefined patterns, regex, or file properties).
2. Creating a Data Filtering Profile ( Objects > Security Profiles > Data Filtering ) where you attach the Data Pattern objects and specify applications, file types, direction, and thresholds/actions.
3. Applying the Data Filtering profile to relevant Security Policy rules (usually those governing outbound traffic).

For enhanced capabilities, consider Palo Alto Networks Enterprise DLP cloud service.

Creating a Data Filtering Profile

This outlines the steps to set up data filtering.

Step 1: Define Data Pattern Object

1. Go to Objects > Custom Objects > Data Patterns and click Add .
2. Enter a descriptive Name .
3. (Optional) Select Shared for multi-VSYS/Panorama.
4. (Optional - Panorama) Select Disable override if needed.
5. (Optional) Enable Data Capture to log the blocked data (requires password setup under Device > Setup > Content-ID > Manage Data Protection ).
6. Choose Pattern Type : Predefined, Regular Expression, or File Properties.
7. Click Add within the pattern object to define rules:
• Predefined: Select the desired pattern from the Name dropdown.
• Regular Expression: Provide a rule Name , select File Type(s) , enter the regex Data Pattern .
• File Properties: Provide a rule Name , select File Type , File Property (e.g., 'TITUS GUID', 'Microsoft MIP Label'), and enter the expected Property Value .



8. Click OK to save the Data Pattern Object.

Step 2: Create Data Filtering Profile

1. Go to Objects > Security Profiles > Data Filtering and click Add .
2. Enter a descriptive Name .
3. Click Add to create a profile rule.
4. Select the Data Pattern object created in Step 1.
5. Specify Applications , File Types , and Direction (upload/download). Ensure File Types align with those specified in the Data Pattern object!
6. Set Alert Threshold (matches to trigger alert).
7. Set Block Threshold (matches to trigger block).
8. Set Log Severity .
9. Click OK to save the Data Filtering Profile.

Step 3: Apply Profile to Policy

1. Edit a Security Policy rule ( Policies > Security ).
2. Go to the Actions tab.
3. Ensure Profile Type is Profiles (or use a Group containing the profile).
4. Select your Data Filtering profile in the corresponding dropdown.
5. Click OK .

Step 4: (Recommended) Disable HTTP Partial Response

This prevents browsers from resuming downloads of files blocked by Data Filtering.

1. Go to Device > Setup > Content-ID and edit Content-ID Settings .
2. Uncheck Allow HTTP partial response .
3. Click OK .

Step 5: Monitor

View logs under Monitor > Logs > Data Filtering .

Predefined Data Filtering Patterns

Palo Alto Networks provides numerous predefined data patterns to help meet compliance requirements and protect common sensitive information types.

Access these when creating a Data Pattern Object ( Objects > Custom Objects > Data Patterns ) by setting the Pattern Type to Predefined Pattern and selecting from the Name dropdown in the rule configuration.

If specific needs aren't met, use regular expressions for custom patterns.

List of Common Predefined Patterns:

Tips & Tricks: Enable Packet Captures on Security Profiles

Enabling "Packet Capture" within Security Profiles (Antivirus, Anti-Spyware, Vulnerability Protection) is useful for troubleshooting false positives or understanding threat behavior.

Enabling Packet Capture

Navigate to Objects > Security Profiles and edit the relevant profile.

Antivirus Profile

Anti-Spyware Profile

Available under the DNS Signatures tab and within specific rule exceptions.

Vulnerability Protection Profile

Available within specific rule exceptions.

Capture Options (Anti-Spyware & Vuln Protection)

• Disabled : No capture.
• Single-packet : Captures one packet when the threat is detected.
• Extended-capture : Captures multiple packets (configurable number) providing more context. Recommended for detailed analysis.

Configuring Extended Capture Length

Set the number of packets for 'extended-capture' under Device > Setup > Content-ID , edit Threat Detection Settings .

Viewing Packet Captures

Go to Monitor > Logs > Threat . Find the relevant log entry and click the green down arrow (packet capture icon) in the second column to download the pcap file.

Packet captures are only generated if the profile action is set to 'allow' or 'alert' . If the action is 'block', 'drop', or any 'reset' variation, the session is terminated immediately, and no (or minimal) capture occurs for that specific threat trigger.

Tips & Tricks: Narrowing the Scope of Threat Exceptions

When a threat signature causes a false positive for legitimate traffic, creating a threat exception is necessary. However, applying a broad exception can inadvertently reduce security. This method provides a more granular approach.

Objective

To apply a threat exception only to the specific traffic causing the false positive, minimizing the impact on overall security.

Procedure

1. Identify Existing Rule & Profile: Determine the Security Policy rule and the attached Security Profile (e.g., Vulnerability Protection) that is triggering the false positive log.

   

2. Clone Security Policy Rule: Clone the identified rule. Rename the clone descriptively (e.g., "Allow Web - Exception") and place it immediately above the original rule.

   

3. Narrow Cloned Rule Scope: Modify the cloned rule's Source, Destination, Application, or Service fields to match only the specific traffic causing the false positive. Be as granular as possible (e.g., specify source/destination IPs, specific application).

   

4. Clone Security Profile: Go to Objects > Security Profiles and clone the profile associated with the original rule (e.g., clone 'VP-Strict'). Rename it descriptively (e.g., "VP-Strict-With-Exception").

   

5. Add Exception to Cloned Profile: Edit the newly cloned profile ("VP-Strict-With-Exception"). Go to the 'Exceptions' tab and add the specific Threat ID that needs to be bypassed, setting its action to 'allow' or 'alert'.

   

6. Associate Cloned Profile with Cloned Rule: Go back to the cloned Security Policy rule ("Allow Web - Exception") and change its Action > Group Profile or Profile setting to use the newly cloned profile ("VP-Strict-With-Exception").

   

7. Commit Changes: Commit the configuration.

   

Result: The specific false-positive traffic will now match the narrow, cloned rule ("Allow Web - Exception") and hit the cloned profile ("VP-Strict-With-Exception") where the threat is allowed. All other traffic previously matching the original rule ("Allow Web") will continue to be processed by the original, stricter profile ('VP-Strict') without the exception.

Flowchart illustrating the logic of using cloned rules and profiles for targeted exceptions.

Common BPA Check Fails for Security Profiles

If Security Profiles are not configured according to Best Practice Assessment recommendations, you might see the following failures in your BPA report:

Common BPA Check Names and Reasons:

• The Anti-Spyware profile settings for low and informational severity events are not set to "default" : Blocking these severities can cause false positives. BPA recommends 'default' or 'alert'.
• The Vulnerability Protection profile settings for low and informational severity events are not set to "default" : Similar to Anti-Spyware, blocking these can break legitimate applications. BPA recommends 'default' or 'alert'.
• Antivirus Decoder action settings not recommended : Actions for protocols like HTTP, SMB should generally be blocking, while email might be alerting.
• Antivirus Decoder WildFire Actions Not Set to Recommended : WildFire verdicts (malware) should typically trigger a 'block' action.
• Antivirus Profile Decoder Wildfire Inline ML Action : BPA recommends enabling WildFire Inline ML for PE files with an appropriate action.
• URL Filtering Profile Inline ML Model Action : BPA recommends enabling the URL Filtering Inline ML model action if available/licensed.
• User Credential Detection is not configured as 'Use Domain Credential Filter' in a URL Filtering Profile : This is the recommended setting to prevent corporate credential reuse on non-corporate sites.
• No visibility into URL categories. : This often means many categories are set to 'allow' instead of 'alert'.
• URL categories that present liability risk to businesses are not blocked. : Categories like 'adult', 'gambling', 'extremism' should be blocked per BPA.
• Potentially malicious URL categories are not blocked. : Categories like 'malware', 'phishing', 'command-and-control', 'unknown' should be blocked per BPA.
• User Credential Submission in the URL Filtering profile is not blocked for categories that may present liability risk... : Credential submission should be blocked for risky categories.
• User Credential Submission in the URL Filtering profile is not blocked for categories that are potentially malicious... : Credential submission should definitely be blocked for malicious categories.
• No visibility into user credential submissions to websites. : Credential submission action for non-blocked categories should be set to 'alert'.

Addressing these BPA findings significantly improves your security posture.

Interactive Quiz: Security Profiles & BPA

Test your understanding of Palo Alto Networks Security Profiles and Best Practice Assessment recommendations.