[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF9RTRDG8NX43MTZGVQAH8":3,"skill-same:01M6AF9RTRDG8NX43MTZGVQAH8":123},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AF9RTRDG8NX43MTZGVQAH8","implementing-next-generation-firewall-with-palo-alto",null,"Configures and deploys Palo Alto Networks next-generation firewalls end-to-end, covering App-ID application-aware policies, User-ID identity-based enforcement, zone-based security rules, SSL decryption for encrypted traffic visibility, and Content-ID threat prevention profiles. Use when moving an enterprise from port-based firewall rules to application- and identity-aware NGFW policy on Palo Alto hardware.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-next-generation-firewall-with-palo-alto\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing next generation firewall with palo alto","firewall","palo-alto","ssl-decryption","threat-prevention","user-id","app-id","ngfw","networks","prevention","identity-aware","security","network-security","network","Enterprise","ssl","pr","identity","cybersecurity","policy","2026-11-10 10:12:30",false,"---\nname: implementing-next-generation-firewall-with-palo-alto\ndescription: Configures and deploys Palo Alto Networks next-generation firewalls end-to-end,\n  covering App-ID application-aware policies, User-ID identity-based enforcement,\n  zone-based security rules, SSL decryption for encrypted traffic visibility, and\n  Content-ID threat prevention profiles. Use when moving an enterprise from\n  port-based firewall rules to application- and identity-aware NGFW policy on\n  Palo Alto hardware.\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- palo-alto\n- ngfw\n- firewall\n- app-id\n- user-id\n- threat-prevention\n- network-security\n- ssl-decryption\n- zone-protection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n- T1553\n---\n\n# Implementing Next-Generation Firewall with Palo Alto\n\n## Overview\n\nPalo Alto Networks Next-Generation Firewalls (NGFWs) move beyond traditional port-based rule enforcement to application-aware, identity-driven security policies. By leveraging App-ID for traffic classification, User-ID for identity-based enforcement, Content-ID for threat inspection, and SSL decryption for encrypted traffic visibility, organizations gain comprehensive control over network traffic. This skill covers end-to-end deployment from initial configuration through advanced threat prevention profiles.\n\n\n## When to Use\n\n- When deploying or configuring implementing next generation firewall with palo alto capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Palo Alto Networks PA-series appliance or VM-Series virtual firewall\n- PAN-OS 10.2 or later\n- Valid Threat Prevention, URL Filtering, and WildFire licenses\n- Network topology documentation with zone definitions\n- LDAP\u002FActive Directory integration credentials for User-ID\n- Internal CA certificate for SSL Forward Proxy decryption\n\n## Core Concepts\n\n### App-ID Technology\n\nApp-ID classifies network traffic by application regardless of port, protocol, or encryption. The classification engine uses multiple identification techniques in sequence:\n\n1. **Application Signatures** - Pattern matching against known application signatures\n2. **SSL\u002FTLS Decryption** - Decrypt traffic to identify applications hidden in encrypted tunnels\n3. **Application Protocol Decoding** - Decode protocols to find applications tunneled within them\n4. **Heuristic Analysis** - Behavioral analysis for applications that evade other methods\n\nThe Policy Optimizer tool assists migration from legacy port-based rules to App-ID rules by analyzing traffic logs and recommending application-specific replacements.\n\n### User-ID Integration\n\nUser-ID maps IP addresses to user identities through multiple methods:\n\n- **Server Monitoring** - Parses Windows Security Event Logs (Event IDs 4624, 4768, 4769)\n- **Syslog Listening** - Receives authentication events from RADIUS, 802.1X, proxies\n- **GlobalProtect** - Maps VPN users automatically\n- **Captive Portal** - Web-based authentication for unknown users\n- **XML API** - Programmatic user mapping from custom sources\n\n### Zone-Based Architecture\n\nZones represent logical segments of the network. Security policies control traffic between zones (inter-zone) and within zones (intra-zone):\n\n| Zone | Purpose | Trust Level |\n|------|---------|-------------|\n| Trust | Internal corporate LAN | High |\n| Untrust | Internet-facing | None |\n| DMZ | Public-facing servers | Medium |\n| Guest | Guest wireless | Low |\n| DataCenter | Server infrastructure | High |\n\n## Workflow\n\n### Step 1: Initial System Configuration\n\nConfigure management interface, DNS, NTP, and system settings:\n\n```\nset deviceconfig system hostname PA-FW01\nset deviceconfig system domain corp.example.com\nset deviceconfig system dns-setting servers primary 10.0.1.10\nset deviceconfig system dns-setting servers secondary 10.0.1.11\nset deviceconfig system ntp-servers primary-ntp-server ntp-server-address 0.pool.ntp.org\nset deviceconfig system timezone US\u002FEastern\nset deviceconfig system login-banner \"Authorized access only. All activity is monitored.\"\n```\n\n### Step 2: Configure Network Zones and Interfaces\n\nDefine security zones and assign interfaces:\n\n```\nset zone Trust network layer3 ethernet1\u002F1\nset zone Untrust network layer3 ethernet1\u002F2\nset zone DMZ network layer3 ethernet1\u002F3\nset zone Guest network layer3 ethernet1\u002F4\n\nset network interface ethernet ethernet1\u002F1 layer3 ip 10.10.0.1\u002F24\nset network interface ethernet ethernet1\u002F1 layer3 interface-management-profile allow-ping\nset network interface ethernet ethernet1\u002F2 layer3 dhcp-client\n\nset network virtual-router default interface [ ethernet1\u002F1 ethernet1\u002F2 ethernet1\u002F3 ethernet1\u002F4 ]\n```\n\n### Step 3: Configure Zone Protection Profiles\n\nProtect against reconnaissance and DoS attacks at the zone level:\n\n```\nset network profiles zone-protection-profile Strict-ZP flood tcp-syn enable yes\nset network profiles zone-protection-profile Strict-ZP flood tcp-syn alert-rate 100\nset network profiles zone-protection-profile Strict-ZP flood tcp-syn activate-rate 500\nset network profiles zone-protection-profile Strict-ZP flood tcp-syn maximal-rate 2000\nset network profiles zone-protection-profile Strict-ZP flood tcp-syn syn-cookies enable yes\n\nset network profiles zone-protection-profile Strict-ZP flood udp enable yes\nset network profiles zone-protection-profile Strict-ZP flood icmp enable yes\n\nset network profiles zone-protection-profile Strict-ZP scan 8003 action block-ip\nset network profiles zone-protection-profile Strict-ZP scan 8003 interval 2\nset network profiles zone-protection-profile Strict-ZP scan 8003 threshold 100\n```\n\n### Step 4: Configure Threat Prevention Profiles\n\nCreate Anti-Virus, Anti-Spyware, Vulnerability Protection, and URL Filtering profiles:\n\n```\n# Anti-Spyware Profile\nset profiles spyware Strict-AS botnet-domains lists default-paloalto-dns packet-capture single-packet\nset profiles spyware Strict-AS botnet-domains sinkhole ipv4-address pan-sinkhole-default-ip\nset profiles spyware Strict-AS rules Block-Critical severity critical action block-ip\n\n# Vulnerability Protection Profile\nset profiles vulnerability Strict-VP rules Block-Critical-High vendor-id any severity [ critical high ] action block-ip\n\n# URL Filtering Profile\nset profiles url-filtering Strict-URL credential-enforcement mode ip-user\nset profiles url-filtering Strict-URL block [ command-and-control malware phishing ]\nset profiles url-filtering Strict-URL alert [ hacking proxy-avoidance-and-anonymizers ]\n\n# File Blocking Profile\nset profiles file-blocking Strict-FB rules Block-Dangerous application any file-type [ bat exe msi ps1 vbs ] direction both action block\n\n# WildFire Analysis Profile\nset profiles wildfire-analysis Strict-WF rules Forward-All application any file-type any direction both analysis public-cloud\n```\n\n### Step 5: Configure SSL Decryption\n\nSet up SSL Forward Proxy for outbound traffic inspection:\n\n```\n# Generate Forward Trust CA certificate\nrequest certificate generate certificate-name SSL-FP-CA algorithm RSA digest sha256 ca yes\n\n# Create Decryption Profile\nset profiles decryption Strict-Decrypt ssl-forward-proxy block-expired-certificate yes\nset profiles decryption Strict-Decrypt ssl-forward-proxy block-untrusted-issuer yes\nset profiles decryption Strict-Decrypt ssl-forward-proxy block-unknown-cert yes\nset profiles decryption Strict-Decrypt ssl-forward-proxy restrict-cert-exts yes\n\n# Create Decryption Policy\nset rulebase decryption rules Decrypt-Outbound from Trust to Untrust source any destination any\nset rulebase decryption rules Decrypt-Outbound action decrypt type ssl-forward-proxy\nset rulebase decryption rules Decrypt-Outbound profile Strict-Decrypt\n\n# Exclude sensitive categories (financial, healthcare)\nset rulebase decryption rules No-Decrypt-Sensitive from Trust to Untrust\nset rulebase decryption rules No-Decrypt-Sensitive category [ financial-services health-and-medicine ]\nset rulebase decryption rules No-Decrypt-Sensitive action no-decrypt\n```\n\n### Step 6: Build Security Policies\n\nCreate application-aware security policies with security profiles:\n\n```\n# Allow business applications from Trust to Internet\nset rulebase security rules Allow-Business from Trust to Untrust\nset rulebase security rules Allow-Business source-user any\nset rulebase security rules Allow-Business application [ office365-enterprise salesforce-base slack-base zoom ]\nset rulebase security rules Allow-Business service application-default\nset rulebase security rules Allow-Business action allow\nset rulebase security rules Allow-Business profile-setting group Strict-Security-Profiles\n\n# Allow web browsing with URL filtering\nset rulebase security rules Allow-Web from Trust to Untrust\nset rulebase security rules Allow-Web application [ web-browsing ssl ]\nset rulebase security rules Allow-Web action allow\nset rulebase security rules Allow-Web profile-setting profiles url-filtering Strict-URL\n\n# Block high-risk applications\nset rulebase security rules Block-HighRisk from any to any\nset rulebase security rules Block-HighRisk application [ bittorrent tor anonymizer ]\nset rulebase security rules Block-HighRisk action deny\nset rulebase security rules Block-HighRisk log-end yes\n\n# Default deny rule (explicit)\nset rulebase security rules Deny-All from any to any source any destination any\nset rulebase security rules Deny-All application any service any action deny\nset rulebase security rules Deny-All log-end yes\n```\n\n### Step 7: Configure Logging and SIEM Integration\n\nForward logs to a SIEM for correlation:\n\n```\n# Configure Syslog Server Profile\nset shared log-settings syslog SIEM-Server server SIEM transport UDP port 514 server 10.0.5.100\nset shared log-settings syslog SIEM-Server server SIEM facility LOG_USER\n\n# Configure Log Forwarding Profile\nset shared log-settings profiles SIEM-Forward match-list Threats log-type threat\nset shared log-settings profiles SIEM-Forward match-list Threats send-syslog SIEM-Server\nset shared log-settings profiles SIEM-Forward match-list Traffic log-type traffic\nset shared log-settings profiles SIEM-Forward match-list Traffic send-syslog SIEM-Server\nset shared log-settings profiles SIEM-Forward match-list URL log-type url\nset shared log-settings profiles SIEM-Forward match-list URL send-syslog SIEM-Server\n```\n\n## Validation and Testing\n\n1. **Policy Audit** - Review with `show running security-policy` and check for shadowed rules\n2. **Traffic Verification** - Monitor Traffic logs for application classification accuracy\n3. **Threat Simulation** - Use EICAR test file and known-bad URLs to validate threat profiles\n4. **SSL Decryption Test** - Verify certificate chain in browser matches Forward Trust CA\n5. **Zone Protection Test** - Run controlled SYN flood to verify SYN cookie activation\n6. **Policy Optimizer** - Run Policy Optimizer to identify remaining port-based rules\n\n```bash\n# Verify active sessions\nshow session all filter application web-browsing\n\n# Check threat log entries\nshow log threat direction equal backward\n\n# Verify App-ID classification\nshow running application-override\n\n# Check system resources\nshow system resources\n```\n\n## Best Practices\n\n- **Least Privilege** - Start with deny-all and explicitly allow only required applications\n- **App-ID Over Port** - Replace port-based rules with application-specific rules using Policy Optimizer\n- **Decryption Coverage** - Decrypt at least 80% of SSL traffic with appropriate privacy exclusions\n- **Security Profile Groups** - Apply Anti-Virus, Anti-Spyware, Vulnerability, URL Filtering, File Blocking, and WildFire as a group\n- **Signature Updates** - Enable automatic daily content updates for Applications and Threats\n- **HA Configuration** - Deploy in active\u002Fpassive HA pair for production environments\n- **Commit Validation** - Always validate configuration before committing: `validate full`\n\n## References\n\n- [PAN-OS Admin Guide](https:\u002F\u002Fdocs.paloaltonetworks.com\u002Fpan-os)\n- [Best Practices for NGFW Deployment](https:\u002F\u002Fdocs.paloaltonetworks.com\u002Fbest-practices)\n- [Palo Alto Firewall Best Practices Checklist](https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcyberpedia\u002Ffirewall-best-practices)\n- [NIST SP 800-41 Rev 1 - Firewall and Policy Guidelines](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-41\u002Frev-1\u002Ffinal)\n","# Implementing Next-Generation Firewall with Palo Alto\n\n## Overview\n\nPalo Alto Networks Next-Generation Firewalls (NGFWs) move beyond traditional port-based rule enforcement to application-aware, identity-driven security policies. By leveraging App-ID for traffic classification, User-ID for identity-based enforcement, Content-ID for threat inspection, and SSL decryption for encrypted traffic visibility, organizations gain comprehensive control over network traffic. This skill covers end-to-end deployment from initial configuration through advanced threat prevention profiles.\n\n\n## When to Use\n\n- When deploying or configuring implementing next generation firewall with palo alto capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Palo Alto Networks PA-series appliance or VM-Series virtual firewall\n- PAN-OS 10.2 or later\n- Valid Threat Prevention, URL Filtering, and WildFire licenses\n- Network topology documentation with zone definitions\n- LDAP\u002FActive Directory integration credentials for User-ID\n- Internal CA certificate for SSL Forward Proxy decryption\n\n## Core Concepts\n\n### App-ID Technology\n\nApp-ID classifies network traffic by application regardless of port, protocol, or encryption. The classification engine uses multiple identification techniques in sequence:\n\n1. **Application Signatures** - Pattern matching against known application signatures\n2. **SSL\u002FTLS Decryption** - Decrypt traffic to identify applications hidden in encrypted tunnels\n3. **Application Protocol Decoding** - Decode protocols to find applications tunneled within them\n4. **Heuristic Analysis** - Behavioral analysis for applications that evade other methods\n\nThe Policy Optimizer tool assists migration from legacy port-based rules to App-ID rules by analyzing traffic logs and recommending application-specific replacements.\n\n### User-ID Integration\n\nUser-ID maps IP addresses to user identities through multiple methods:\n\n- **Server Monitoring** - Parses Windows Security Event Logs (Event IDs 4624, 4768, 4769)\n- **Syslog Listening** - Receives authentication events from RADIUS, 802.1X, proxies\n- **GlobalProtect** - Maps VPN users automatically\n- **Captive Portal** - Web-based authentication for unknown users\n- **XML API** - Programmatic user mapping from custom sources\n\n### Zone-Based Architecture\n\nZones represent logical segments of the network. Security policies control traffic between zones (inter-zone) and within zones (intra-zone):\n\n| Zone | Purpose | Trust Level |\n|------|---------|-------------|\n| Trust | Internal corporate LAN | High |\n| Untrust | Internet-facing | None |\n| DMZ | Public-facing servers | Medium |\n| Guest | Guest wireless | Low |\n| DataCenter | Server infrastructure | High |\n\n## Workflow\n\n### Step 1: Initial System Configuration\n\nConfigure management interface, DNS, NTP, and system settings:\n\n```\nset deviceconfig system hostname PA-FW01\nset deviceconfig system domain corp.example.com\nset deviceconfig system dns-setting servers primary 10.0.1.10\nset deviceconfig system dns-setting servers secondary 10.0.1.11\nset deviceconfig system ntp-servers primary-ntp-server ntp-server-address 0.pool.ntp.org\nset deviceconfig system timezone US\u002FEastern\nset deviceconfig system login-banner \"Authorized access only. All activity is monitored.\"\n```\n\n### Step 2: Configure Network Zones and Interfaces\n\nDefine security zones and assign interfaces:\n\n```\nset zone Trust network layer3 ethernet1\u002F1\nset zone Untrust network layer3 ethernet1\u002F2\nset zone DMZ network layer3 ethernet1\u002F3\nset zone Guest network layer3 ethernet1\u002F4\n\nset network interface ethernet ethernet1\u002F1 layer3 ip 10.10.0.1\u002F24\nset network interface ethernet ethernet1\u002F1 layer3 interface-management-profile allow-ping\nset network interface ethernet ethernet1\u002F2 layer3 dhcp-client\n\nset network virtual-router default interface [ ethernet1\u002F1 ethernet1\u002F2 ethernet1\u002F3 ethernet1\u002F4 ]\n```\n\n### Step 3: Configure Zone Protection Profiles\n\nProtect against reconnaissance and DoS attacks at the zone level:\n\n```\nset network profiles zone-protection-profile Strict-ZP flood tcp-syn enable yes\nset network profiles zone-protection-profile Strict-ZP flood tcp-syn alert-rate 100\nset network profiles zone-protection-profile Strict-ZP flood tcp-syn activate-rate 500\nset network profiles zone-protection-profile Strict-ZP flood tcp-syn maximal-rate 2000\nset network profiles zone-protection-profile Strict-ZP flood tcp-syn syn-cookies enable yes\n\nset network profiles zone-protection-profile Strict-ZP flood udp enable yes\nset network profiles zone-protection-profile Strict-ZP flood icmp enable yes\n\nset network profiles zone-protection-profile Strict-ZP scan 8003 action block-ip\nset network profiles zone-protection-profile Strict-ZP scan 8003 interval 2\nset network profiles zone-protection-profile Strict-ZP scan 8003 threshold 100\n```\n\n### Step 4: Configure Threat Prevention Profiles\n\nCreate Anti-Virus, Anti-Spyware, Vulnerability Protection, and URL Filtering profiles:\n\n```\n# Anti-Spyware Profile\nset profiles spyware Strict-AS botnet-domains lists default-paloalto-dns packet-capture single-packet\nset profiles spyware Strict-AS botnet-domains sinkhole ipv4-address pan-sinkhole-default-ip\nset profiles spyware Strict-AS rules Block-Critical severity critical action block-ip\n\n# Vulnerability Protection Profile\nset profiles vulnerability Strict-VP rules Block-Critical-High vendor-id any severity [ critical high ] action block-ip\n\n# URL Filtering Profile\nset profiles url-filtering Strict-URL credential-enforcement mode ip-user\nset profiles url-filtering Strict-URL block [ command-and-control malware phishing ]\nset profiles url-filtering Strict-URL alert [ hacking proxy-avoidance-and-anonymizers ]\n\n# File Blocking Profile\nset profiles file-blocking Strict-FB rules Block-Dangerous application any file-type [ bat exe msi ps1 vbs ] direction both action block\n\n# WildFire Analysis Profile\nset profiles wildfire-analysis Strict-WF rules Forward-All application any file-type any direction both analysis public-cloud\n```\n\n### Step 5: Configure SSL Decryption\n\nSet up SSL Forward Proxy for outbound traffic inspection:\n\n```\n# Generate Forward Trust CA certificate\nrequest certificate generate certificate-name SSL-FP-CA algorithm RSA digest sha256 ca yes\n\n# Create Decryption Profile\nset profiles decryption Strict-Decrypt ssl-forward-proxy block-expired-certificate yes\nset profiles decryption Strict-Decrypt ssl-forward-proxy block-untrusted-issuer yes\nset profiles decryption Strict-Decrypt ssl-forward-proxy block-unknown-cert yes\nset profiles decryption Strict-Decrypt ssl-forward-proxy restrict-cert-exts yes\n\n# Create Decryption Policy\nset rulebase decryption rules Decrypt-Outbound from Trust to Untrust source any destination any\nset rulebase decryption rules Decrypt-Outbound action decrypt type ssl-forward-proxy\nset rulebase decryption rules Decrypt-Outbound profile Strict-Decrypt\n\n# Exclude sensitive categories (financial, healthcare)\nset rulebase decryption rules No-Decrypt-Sensitive from Trust to Untrust\nset rulebase decryption rules No-Decrypt-Sensitive category [ financial-services health-and-medicine ]\nset rulebase decryption rules No-Decrypt-Sensitive action no-decrypt\n```\n\n### Step 6: Build Security Policies\n\nCreate application-aware security policies with security profiles:\n\n```\n# Allow business applications from Trust to Internet\nset rulebase security rules Allow-Business from Trust to Untrust\nset rulebase security rules Allow-Business source-user any\nset rulebase security rules Allow-Business application [ office365-enterprise salesforce-base slack-base zoom ]\nset rulebase security rules Allow-Business service application-default\nset rulebase security rules Allow-Business action allow\nset rulebase security rules Allow-Business profile-setting group Strict-Security-Profiles\n\n# Allow web browsing with URL filtering\nset rulebase security rules Allow-Web from Trust to Untrust\nset rulebase security rules Allow-Web application [ web-browsing ssl ]\nset rulebase security rules Allow-Web action allow\nset rulebase security rules Allow-Web profile-setting profiles url-filtering Strict-URL\n\n# Block high-risk applications\nset rulebase security rules Block-HighRisk from any to any\nset rulebase security rules Block-HighRisk application [ bittorrent tor anonymizer ]\nset rulebase security rules Block-HighRisk action deny\nset rulebase security rules Block-HighRisk log-end yes\n\n# Default deny rule (explicit)\nset rulebase security rules Deny-All from any to any source any destination any\nset rulebase security rules Deny-All application any service any action deny\nset rulebase security rules Deny-All log-end yes\n```\n\n### Step 7: Configure Logging and SIEM Integration\n\nForward logs to a SIEM for correlation:\n\n```\n# Configure Syslog Server Profile\nset shared log-settings syslog SIEM-Server server SIEM transport UDP port 514 server 10.0.5.100\nset shared log-settings syslog SIEM-Server server SIEM facility LOG_USER\n\n# Configure Log Forwarding Profile\nset shared log-settings profiles SIEM-Forward match-list Threats log-type threat\nset shared log-settings profiles SIEM-Forward match-list Threats send-syslog SIEM-Server\nset shared log-settings profiles SIEM-Forward match-list Traffic log-type traffic\nset shared log-settings profiles SIEM-Forward match-list Traffic send-syslog SIEM-Server\nset shared log-settings profiles SIEM-Forward match-list URL log-type url\nset shared log-settings profiles SIEM-Forward match-list URL send-syslog SIEM-Server\n```\n\n## Validation and Testing\n\n1. **Policy Audit** - Review with `show running security-policy` and check for shadowed rules\n2. **Traffic Verification** - Monitor Traffic logs for application classification accuracy\n3. **Threat Simulation** - Use EICAR test file and known-bad URLs to validate threat profiles\n4. **SSL Decryption Test** - Verify certificate chain in browser matches Forward Trust CA\n5. **Zone Protection Test** - Run controlled SYN flood to verify SYN cookie activation\n6. **Policy Optimizer** - Run Policy Optimizer to identify remaining port-based rules\n\n```bash\n# Verify active sessions\nshow session all filter application web-browsing\n\n# Check threat log entries\nshow log threat direction equal backward\n\n# Verify App-ID classification\nshow running application-override\n\n# Check system resources\nshow system resources\n```\n\n## Best Practices\n\n- **Least Privilege** - Start with deny-all and explicitly allow only required applications\n- **App-ID Over Port** - Replace port-based rules with application-specific rules using Policy Optimizer\n- **Decryption Coverage** - Decrypt at least 80% of SSL traffic with appropriate privacy exclusions\n- **Security Profile Groups** - Apply Anti-Virus, Anti-Spyware, Vulnerability, URL Filtering, File Blocking, and WildFire as a group\n- **Signature Updates** - Enable automatic daily content updates for Applications and Threats\n- **HA Configuration** - Deploy in active\u002Fpassive HA pair for production environments\n- **Commit Validation** - Always validate configuration before committing: `validate full`\n\n## References\n\n- [PAN-OS Admin Guide](https:\u002F\u002Fdocs.paloaltonetworks.com\u002Fpan-os)\n- [Best Practices for NGFW Deployment](https:\u002F\u002Fdocs.paloaltonetworks.com\u002Fbest-practices)\n- [Palo Alto Firewall Best Practices Checklist](https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcyberpedia\u002Ffirewall-best-practices)\n- [NIST SP 800-41 Rev 1 - Firewall and Policy Guidelines](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-41\u002Frev-1\u002Ffinal)\n",{"name":5,"tags":49,"author":51,"domain":42,"license":15,"version":52,"nist_csf":53,"subdomain":36,"description":7,"mitre_attack":58},[26,31,25,30,29,28,36,27,50],"zone-protection","mahipal","1.0",[54,55,56,57],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02",[59,60,61,62,63],"T1046","T1040","T1557","T1071","T1553","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-next-generation-firewall-with-palo-alto",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-next-generation-firewall-with-palo-alto",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-next-generation-firewall-with-palo-alto",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-next-generation-firewall-with-palo-alto","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-next-generation-firewall-with-palo-alto\u002FSKILL.md",true,[88,94,99,105,109,113,119],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"assets\u002Ftemplate.md","ASSET","资产文件",2460,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-next-generation-firewall-with-palo-alto\u002Fassets\u002Ftemplate.md",{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-next-generation-firewall-with-palo-alto\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",1148,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-next-generation-firewall-with-palo-alto\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fstandards.md",1510,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-next-generation-firewall-with-palo-alto\u002Freferences\u002Fstandards.md",{"path":110,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fworkflows.md",2338,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-next-generation-firewall-with-palo-alto\u002Freferences\u002Fworkflows.md",{"path":114,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":117,"sourceHtmlUrl":118},"scripts\u002Fagent.py","SCRIPT","脚本",4617,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-next-generation-firewall-with-palo-alto\u002Fscripts\u002Fagent.py",{"path":120,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fprocess.py",9509,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-next-generation-firewall-with-palo-alto\u002Fscripts\u002Fprocess.py",[124,148,171,199,225,252],{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":131,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[130],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[132,133,134,135,35,42,136,41,40,137,138,139,140,141,142,143,144,145,146,147],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":155,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[154],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[156,144,157,158,35,43,42,40,159,160,161,162,163,164,165,166,167,168,169,170],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":181,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[177,180],{"categoryNo":178,"categoryName":179,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[165,182,183,184,185,42,186,187,159,188,189,190,191,192,193,194,195,196,197,198],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":206,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[205],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[207,208,209,42,210,211,212,213,214,215,216,217,218,219,220,221,162,222,223,224],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":232,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[231],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[233,234,235,42,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":259,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[258],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[35,260,42,261,262,263,264,265,266,267,268,194,269,195,270,271,272,273,274,275],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]