{"assessment":{"id":"00000000-0000-4000-8000-000000000001","label":"Sample: lab edge firewall (PAN-OS 11.1)","status":"done","created_at":"2026-10-31T12:00:00+00:00","vendor":"panos","device_type":"firewall","version":"11.1.0","score":0,"counts":{"critical":16,"high":19,"medium":18,"low":3,"info":7,"passed":0},"retention_expires_at":"2027-10-31T12:00:00+00:00","locale":"en","progress":100,"stage_message":"Analysis complete.","scope":{"vsys":["vsys1"],"device_groups":[],"templates":[],"rule_count":15,"object_count":18,"nat_rule_count":4,"zone_count":3},"rulepack":{"id":"PAN-BP","version":"0.1.0"},"ai":{"provider":"none","model":null,"enriched":false},"findings":[{"finding_id":"PAN-SEC-026-a639bb","check_id":"PAN-SEC-026","title":"Management access allows HTTP or Telnet","category":"platform_hardening","severity":"critical","risk":{"exposure":5,"privilege":5,"impact":5,"control_gap":3,"score":375},"confidence":1,"source":"deterministic","evidence":[{"object":"deviceconfig/system/service","object_type":"device_system","xpath":"/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system","snippet":"","scope":"localhost.localdomain"},{"object":"MGMT-ALLOW-ALL","object_type":"interface_mgmt_profile","xpath":"/config/devices/entry[@name='localhost.localdomain']/network/profiles/interface-management-profile/entry[@name='MGMT-ALLOW-ALL']","snippet":"","scope":"localhost.localdomain"}],"risk_text":"Clear text management access is available: telnet is enabled on the management interface; http is enabled on the management interface; interface management profile 'MGMT-ALLOW-ALL' permits telnet, http. Administrator credentials cross the network unencrypted and can be captured by anyone on the path.","remediation":["Set disable-telnet and disable-http to yes under deviceconfig system service.","Remove telnet and http from every interface management profile.","Use HTTPS and SSH only."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-001-6fb517","check_id":"PAN-SEC-001","title":"Allow rule matches any source and any destination","category":"policy_hygiene","severity":"critical","risk":{"exposure":5,"privilege":4,"impact":5,"control_gap":3,"score":300},"confidence":1,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Any-Any-Permit-All' allows traffic from any source to any destination between zones untrust and any. Every host reachable on those zones can reach every other host the rule permits.","remediation":["Replace the any source with the address objects or groups that actually need access.","Replace the any destination with the specific servers or subnets being reached.","Re-test the rule with a policy match query before committing."],"limitations":["Whether the permitted paths are actually used cannot be proven without traffic logs."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-011-4a8ab6","check_id":"PAN-SEC-011","title":"Inbound internet rule without threat prevention","category":"security_profiles","severity":"critical","risk":{"exposure":5,"privilege":4,"impact":5,"control_gap":3,"score":300},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Inbound-Web-DMZ","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Inbound-Web-DMZ']","snippet":"<entry name=\"Inbound-Web-DMZ\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>web-server-1</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application>\n                    <member>web-browsing</member>\n                    <member>ssl</member>\n                  </application>\n                  <service>\n                    <member>service-http</member>\n                    <member>service-https</member>\n                  </service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Partial-Profiles</member></group>\n                  </profile-setting>\n                  <description>Publish the corporate web site</description>\n                  <tag><member>dmz</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Partial-Profiles","object_type":"profile_group","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/profile-group/entry[@name='Partial-Profiles']","snippet":"","scope":"vsys1"}],"risk_text":"Rule 'Inbound-Web-DMZ' allows traffic arriving from zone(s) untrust with no antivirus, anti-spyware, vulnerability protection. Exploit attempts against the exposed service reach it uninspected.","remediation":["Attach a profile group containing antivirus, anti-spyware and vulnerability protection.","Set the vulnerability protection profile to block critical, high and medium severity signatures.","Confirm the threat signatures are updating on schedule."],"limitations":["Internet exposure is inferred from zone names, not from routing or interface data."],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 6.7","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-011-a6f8b6","check_id":"PAN-SEC-011","title":"Inbound internet rule without threat prevention","category":"security_profiles","severity":"critical","risk":{"exposure":5,"privilege":4,"impact":5,"control_gap":3,"score":300},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Any-Any-Permit-All' allows traffic arriving from zone(s) untrust with no antivirus, anti-spyware, vulnerability protection. Exploit attempts against the exposed service reach it uninspected.","remediation":["Attach a profile group containing antivirus, anti-spyware and vulnerability protection.","Set the vulnerability protection profile to block critical, high and medium severity signatures.","Confirm the threat signatures are updating on schedule."],"limitations":["Internet exposure is inferred from zone names, not from routing or interface data."],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 6.7","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-011-c573cb","check_id":"PAN-SEC-011","title":"Inbound internet rule without threat prevention","category":"security_profiles","severity":"critical","risk":{"exposure":5,"privilege":4,"impact":5,"control_gap":3,"score":300},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Temp-Vendor-Access-tmp","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp']","snippet":"<entry name=\"Temp-Vendor-Access-tmp\">\n                  <from><member>untrust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>partner-net</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <description>Temporary access for the vendor migration, remove after cutover</description>\n                  <tag><member>temporary</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Temp-Vendor-Access-tmp' allows traffic arriving from zone(s) untrust with no antivirus, anti-spyware, vulnerability protection. Exploit attempts against the exposed service reach it uninspected.","remediation":["Attach a profile group containing antivirus, anti-spyware and vulnerability protection.","Set the vulnerability protection profile to block critical, high and medium severity signatures.","Confirm the threat signatures are updating on schedule."],"limitations":["Internet exposure is inferred from zone names, not from routing or interface data."],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 6.7","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-011-e3b8bc","check_id":"PAN-SEC-011","title":"Inbound internet rule without threat prevention","category":"security_profiles","severity":"critical","risk":{"exposure":5,"privilege":4,"impact":5,"control_gap":3,"score":300},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Legacy-Partner-Inbound","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound']","snippet":"<entry name=\"Legacy-Partner-Inbound\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any-ipv4</member></source>\n                  <destination><member>dmz-servers</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Kept from the 2019 build, source object looks specific but is not</description>\n                  <tag><member>legacy</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Legacy-Partner-Inbound' allows traffic arriving from zone(s) untrust with no antivirus, anti-spyware, vulnerability protection. Exploit attempts against the exposed service reach it uninspected.","remediation":["Attach a profile group containing antivirus, anti-spyware and vulnerability protection.","Set the vulnerability protection profile to block critical, high and medium severity signatures.","Confirm the threat signatures are updating on schedule."],"limitations":["Internet exposure is inferred from zone names, not from routing or interface data."],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 6.7","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-023-361d6e","check_id":"PAN-SEC-023","title":"Inbound destination NAT without a restrictive security rule","category":"nat_exposure","severity":"critical","risk":{"exposure":5,"privilege":4,"impact":5,"control_gap":3,"score":300},"confidence":0.8,"source":"deterministic","evidence":[{"object":"DNAT-Unpublished-Admin","object_type":"nat_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='DNAT-Unpublished-Admin']","snippet":"<entry name=\"DNAT-Unpublished-Admin\">\n                  <from><member>untrust</member></from>\n                  <to><member>untrust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>203.0.113.11</member></destination>\n                  <service>tcp-8080</service>\n                  <nat-type>ipv4</nat-type>\n                  <to-interface>ethernet1/1</to-interface>\n                  <destination-translation>\n                    <translated-address>10.10.5.99</translated-address>\n                    <translated-port>8080</translated-port>\n                  </destination-translation>\n                  <description>Admin console published during an incident</description>\n                </entry>","scope":"vsys1"},{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"},{"object":"Outbound-Web","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Outbound-Web']","snippet":"<entry name=\"Outbound-Web\">\n                  <from><member>trust</member></from>\n                  <to><member>untrust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application>\n                    <member>web-browsing</member>\n                    <member>ssl</member>\n                  </application>\n                  <service><member>application-default</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>NoUrl-Profiles</member></group>\n                  </profile-setting>\n                  <description>Corporate internet browsing</description>\n                  <tag><member>egress</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Broad-Datacenter-Allow","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow']","snippet":"<entry name=\"Broad-Datacenter-Allow\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>all-networks</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Datacenter east west traffic</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"NAT rule 'DNAT-Unpublished-Admin' publishes internal address 10.10.5.99 to zone(s) untrust from untrust. 4 broad allow rule(s) could match it, none of which restrict the source. Either the service is unreachable, or it is reachable from anywhere.","remediation":["Inspect existing security rules using original pre-NAT addresses and ports with post-NAT destination zones. Do not create access solely to clear this finding.","Confirm the intended audience before restricting source and service.","Validate effective rule order, forwarding, logging and threat-prevention profiles."],"limitations":["A matching security rule may live in a Panorama device group that is not part of this export."],"cis_ref":null,"blast_radius":{"hosts":1,"services":4},"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-023-867eaf","check_id":"PAN-SEC-023","title":"Inbound destination NAT without a restrictive security rule","category":"nat_exposure","severity":"critical","risk":{"exposure":5,"privilege":4,"impact":5,"control_gap":3,"score":300},"confidence":0.8,"source":"deterministic","evidence":[{"object":"DNAT-Web-Any-Service","object_type":"nat_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='DNAT-Web-Any-Service']","snippet":"<entry name=\"DNAT-Web-Any-Service\">\n                  <from><member>untrust</member></from>\n                  <to><member>untrust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>203.0.113.10</member></destination>\n                  <service>any</service>\n                  <nat-type>ipv4</nat-type>\n                  <to-interface>ethernet1/1</to-interface>\n                  <destination-translation>\n                    <translated-address>10.20.0.10</translated-address>\n                  </destination-translation>\n                  <description>Publish the web server</description>\n                </entry>","scope":"vsys1"},{"object":"Inbound-Web-DMZ","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Inbound-Web-DMZ']","snippet":"<entry name=\"Inbound-Web-DMZ\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>web-server-1</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application>\n                    <member>web-browsing</member>\n                    <member>ssl</member>\n                  </application>\n                  <service>\n                    <member>service-http</member>\n                    <member>service-https</member>\n                  </service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Partial-Profiles</member></group>\n                  </profile-setting>\n                  <description>Publish the corporate web site</description>\n                  <tag><member>dmz</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"},{"object":"Outbound-Web","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Outbound-Web']","snippet":"<entry name=\"Outbound-Web\">\n                  <from><member>trust</member></from>\n                  <to><member>untrust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application>\n                    <member>web-browsing</member>\n                    <member>ssl</member>\n                  </application>\n                  <service><member>application-default</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>NoUrl-Profiles</member></group>\n                  </profile-setting>\n                  <description>Corporate internet browsing</description>\n                  <tag><member>egress</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"NAT rule 'DNAT-Web-Any-Service' publishes internal address 10.20.0.10 to zone(s) untrust from untrust. 6 broad allow rule(s) could match it, none of which restrict the source. Either the service is unreachable, or it is reachable from anywhere.","remediation":["Inspect existing security rules using original pre-NAT addresses and ports with post-NAT destination zones. Do not create access solely to clear this finding.","Confirm the intended audience before restricting source and service.","Validate effective rule order, forwarding, logging and threat-prevention profiles."],"limitations":["A matching security rule may live in a Panorama device group that is not part of this export."],"cis_ref":null,"blast_radius":{"hosts":1,"services":6},"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-027-256b63","check_id":"PAN-SEC-027","title":"Interface management profile has no permitted IP restriction","category":"platform_hardening","severity":"critical","risk":{"exposure":5,"privilege":5,"impact":4,"control_gap":3,"score":300},"confidence":1,"source":"deterministic","evidence":[{"object":"MGMT-ALLOW-ALL","object_type":"interface_mgmt_profile","xpath":"/config/devices/entry[@name='localhost.localdomain']/network/profiles/interface-management-profile/entry[@name='MGMT-ALLOW-ALL']","snippet":"","scope":"localhost.localdomain"},{"object":"ethernet1/1","object_type":"interface","xpath":"/config/devices/entry[@name='localhost.localdomain']/network/interface/ethernet/entry[@name='ethernet1/1']","snippet":"","scope":"localhost.localdomain"}],"risk_text":"Interface management profile 'MGMT-ALLOW-ALL' enables http, https, telnet, ssh, snmp with no permitted IP list. It is attached to 1 data interface(s), so the management plane answers every host that can route to those addresses.","remediation":["Add the administrator jump host subnets to the permitted IP list on the profile.","Remove management services from any interface that does not need them."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 1.2.2","blast_radius":{"hosts":1,"services":5},"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-022-832d34","check_id":"PAN-SEC-022","title":"Permissive allow rule is evaluated before restrictive rules","category":"rule_logic","severity":"critical","risk":{"exposure":5,"privilege":4,"impact":4,"control_gap":3,"score":240},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"},{"object":"Deny-Guest-To-Prod","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Deny-Guest-To-Prod']","snippet":"<entry name=\"Deny-Guest-To-Prod\">\n                  <from><member>untrust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>deny</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Guests must never reach the database</description>\n                  <tag><member>security</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Any-Any-Permit-All' permits any source to any destination for any application and service, and sits above 1 deny rule(s) in chain 'vsys1'. Those deny rules can only ever see traffic this rule did not already allow.","remediation":["Move the deny rules above the permissive allow rule.","Narrow the permissive rule so it cannot swallow the traffic the deny rules target."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-029-438ab6","check_id":"PAN-SEC-029","title":"Well known administrator account is active with full privilege","category":"platform_hardening","severity":"critical","risk":{"exposure":4,"privilege":5,"impact":4,"control_gap":3,"score":240},"confidence":0.9,"source":"deterministic","evidence":[{"object":"admin","object_type":"admin_user","xpath":"/config/mgt-config/users/entry[@name='admin']","snippet":"","scope":"mgt-config"}],"risk_text":"Administrator 'admin' has a predictable name and holds the superuser role with a local password and no authentication profile. Predictable administrator names are the first target of credential stuffing.","remediation":["Create named administrator accounts and disable the generic ones.","Bind administrators to an authentication profile with multi factor authentication.","Rotate any shared credential that was in use."],"limitations":["The password itself is never read; only the account name and role."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-029-eebff3","check_id":"PAN-SEC-029","title":"Well known administrator account is active with full privilege","category":"platform_hardening","severity":"critical","risk":{"exposure":4,"privilege":5,"impact":4,"control_gap":3,"score":240},"confidence":0.9,"source":"deterministic","evidence":[{"object":"apiuser","object_type":"admin_user","xpath":"/config/mgt-config/users/entry[@name='apiuser']","snippet":"","scope":"mgt-config"}],"risk_text":"Administrator 'apiuser' has a predictable name and holds the superuser role with a local password and no authentication profile. Predictable administrator names are the first target of credential stuffing.","remediation":["Create named administrator accounts and disable the generic ones.","Bind administrators to an authentication profile with multi factor authentication.","Rotate any shared credential that was in use."],"limitations":["The password itself is never read; only the account name and role."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-010-b2a007","check_id":"PAN-SEC-010","title":"Allow rule without any security profile","category":"security_profiles","severity":"critical","risk":{"exposure":5,"privilege":3,"impact":4,"control_gap":3,"score":180},"confidence":1,"source":"deterministic","evidence":[{"object":"Legacy-Partner-Inbound","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound']","snippet":"<entry name=\"Legacy-Partner-Inbound\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any-ipv4</member></source>\n                  <destination><member>dmz-servers</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Kept from the 2019 build, source object looks specific but is not</description>\n                  <tag><member>legacy</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Legacy-Partner-Inbound' allows traffic with no security profile group and no inline profiles. Nothing on this path is inspected for malware, exploits or command and control.","remediation":["Attach a security profile group to the rule.","If no suitable group exists, create one from the Palo Alto Networks best practice profiles.","Verify the group includes antivirus, anti-spyware, vulnerability protection and WildFire."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 6.7","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-010-e15b16","check_id":"PAN-SEC-010","title":"Allow rule without any security profile","category":"security_profiles","severity":"critical","risk":{"exposure":5,"privilege":3,"impact":4,"control_gap":3,"score":180},"confidence":1,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Any-Any-Permit-All' allows traffic with no security profile group and no inline profiles. Nothing on this path is inspected for malware, exploits or command and control.","remediation":["Attach a security profile group to the rule.","If no suitable group exists, create one from the Palo Alto Networks best practice profiles.","Verify the group includes antivirus, anti-spyware, vulnerability protection and WildFire."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 6.7","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-018-b80d99","check_id":"PAN-SEC-018","title":"Allow rule uses an object that resolves to the whole internet","category":"objects","severity":"critical","risk":{"exposure":5,"privilege":3,"impact":4,"control_gap":3,"score":180},"confidence":1,"source":"deterministic","evidence":[{"object":"Legacy-Partner-Inbound","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound']","snippet":"<entry name=\"Legacy-Partner-Inbound\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any-ipv4</member></source>\n                  <destination><member>dmz-servers</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Kept from the 2019 build, source object looks specific but is not</description>\n                  <tag><member>legacy</member></tag>\n                </entry>","scope":"vsys1"},{"object":"any-ipv4","object_type":"address_object","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address/entry[@name='any-ipv4']","snippet":"","scope":"vsys1"}],"risk_text":"Rule 'Legacy-Partner-Inbound' names any-ipv4 as its source, which resolves to 0.0.0.0/0. The rule reads as specific but matches every address.","remediation":["Replace the object with the real address range.","If the intent really is the whole internet, rename the object so reviewers can see it."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-021-7c0a70","check_id":"PAN-SEC-021","title":"Broad allow rule generalizes earlier specific rules","category":"rule_logic","severity":"critical","risk":{"exposure":5,"privilege":3,"impact":4,"control_gap":3,"score":180},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"},{"object":"Block-Known-Bad-Sources","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Block-Known-Bad-Sources']","snippet":"<entry name=\"Block-Known-Bad-Sources\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>partner-net</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>deny</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Drop traffic from a partner range that was compromised</description>\n                  <tag><member>security</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Inbound-Web-DMZ","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Inbound-Web-DMZ']","snippet":"<entry name=\"Inbound-Web-DMZ\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>web-server-1</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application>\n                    <member>web-browsing</member>\n                    <member>ssl</member>\n                  </application>\n                  <service>\n                    <member>service-http</member>\n                    <member>service-https</member>\n                  </service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Partial-Profiles</member></group>\n                  </profile-setting>\n                  <description>Publish the corporate web site</description>\n                  <tag><member>dmz</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Inbound-Mail","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Inbound-Mail']","snippet":"<entry name=\"Inbound-Mail\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>mail-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>smtp</member></application>\n                  <service><member>smtp-25</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>yes</log-start>\n                  <log-end>no</log-end>\n                  <profile-setting>\n                    <group><member>Strict-Profiles</member></group>\n                  </profile-setting>\n                  <description>Inbound SMTP to the mail relay</description>\n                  <tag><member>dmz</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Temp-Vendor-Access-tmp","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp']","snippet":"<entry name=\"Temp-Vendor-Access-tmp\">\n                  <from><member>untrust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>partner-net</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <description>Temporary access for the vendor migration, remove after cutover</description>\n                  <tag><member>temporary</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Allow rule 'Any-Any-Permit-All' is broad enough to cover 4 earlier, more specific rules. Everything those rules were narrowing is permitted anyway, so the specificity above it does not constrain traffic.","remediation":["Narrow the broad rule to the applications, services and addresses actually required.","Or remove the specific rules it makes redundant, so the policy states its real intent."],"limitations":[],"cis_ref":null,"blast_radius":{"hosts":4,"services":1},"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-010-270494","check_id":"PAN-SEC-010","title":"Allow rule without any security profile","category":"security_profiles","severity":"high","risk":{"exposure":4,"privilege":3,"impact":4,"control_gap":3,"score":144},"confidence":1,"source":"deterministic","evidence":[{"object":"Temp-Vendor-Access-tmp","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp']","snippet":"<entry name=\"Temp-Vendor-Access-tmp\">\n                  <from><member>untrust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>partner-net</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <description>Temporary access for the vendor migration, remove after cutover</description>\n                  <tag><member>temporary</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Temp-Vendor-Access-tmp' allows traffic with no security profile group and no inline profiles. Nothing on this path is inspected for malware, exploits or command and control.","remediation":["Attach a security profile group to the rule.","If no suitable group exists, create one from the Palo Alto Networks best practice profiles.","Verify the group includes antivirus, anti-spyware, vulnerability protection and WildFire."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 6.7","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-018-2209e4","check_id":"PAN-SEC-018","title":"Allow rule uses an object that resolves to the whole internet","category":"objects","severity":"high","risk":{"exposure":4,"privilege":3,"impact":4,"control_gap":3,"score":144},"confidence":1,"source":"deterministic","evidence":[{"object":"Broad-Datacenter-Allow","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow']","snippet":"<entry name=\"Broad-Datacenter-Allow\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>all-networks</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Datacenter east west traffic</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"},{"object":"all-networks","object_type":"address_group","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='all-networks']","snippet":"","scope":"vsys1"}],"risk_text":"Rule 'Broad-Datacenter-Allow' names all-networks as its source, which resolves to 0.0.0.0/0. The rule reads as specific but matches every address.","remediation":["Replace the object with the real address range.","If the intent really is the whole internet, rename the object so reviewers can see it."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-007-3293d1","check_id":"PAN-SEC-007","title":"Allow rule with logging fully disabled","category":"policy_hygiene","severity":"high","risk":{"exposure":5,"privilege":3,"impact":3,"control_gap":3,"score":135},"confidence":1,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Any-Any-Permit-All' permits traffic and logs nothing, at session start or at session end. There is no record of what crossed this path.","remediation":["Enable log at session end on the rule.","Confirm the log forwarding profile sends the traffic log to syslog or Cortex."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-024-a53f17","check_id":"PAN-SEC-024","title":"Destination NAT published with a broad service","category":"nat_exposure","severity":"high","risk":{"exposure":4,"privilege":4,"impact":4,"control_gap":2,"score":128},"confidence":1,"source":"deterministic","evidence":[{"object":"DNAT-Web-Any-Service","object_type":"nat_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='DNAT-Web-Any-Service']","snippet":"<entry name=\"DNAT-Web-Any-Service\">\n                  <from><member>untrust</member></from>\n                  <to><member>untrust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>203.0.113.10</member></destination>\n                  <service>any</service>\n                  <nat-type>ipv4</nat-type>\n                  <to-interface>ethernet1/1</to-interface>\n                  <destination-translation>\n                    <translated-address>10.20.0.10</translated-address>\n                  </destination-translation>\n                  <description>Publish the web server</description>\n                </entry>","scope":"vsys1"}],"risk_text":"NAT rule 'DNAT-Web-Any-Service' translates to 10.20.0.10 with service any, so every TCP and UDP port on that host is reachable through the translation, not only the service that was meant to be published.","remediation":["Set the NAT rule service to the specific service object being published.","Add the translated port so only that port is forwarded."],"limitations":[],"cis_ref":null,"blast_radius":{"hosts":1,"services":65535},"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-001-d861eb","check_id":"PAN-SEC-001","title":"Allow rule matches any source and any destination","category":"policy_hygiene","severity":"high","risk":{"exposure":2,"privilege":4,"impact":5,"control_gap":3,"score":120},"confidence":1,"source":"deterministic","evidence":[{"object":"Broad-Datacenter-Allow","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow']","snippet":"<entry name=\"Broad-Datacenter-Allow\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>all-networks</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Datacenter east west traffic</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Broad-Datacenter-Allow' allows traffic from any source to any destination between zones trust and trust. Every host reachable on those zones can reach every other host the rule permits.","remediation":["Replace the any source with the address objects or groups that actually need access.","Replace the any destination with the specific servers or subnets being reached.","Re-test the rule with a policy match query before committing."],"limitations":["Whether the permitted paths are actually used cannot be proven without traffic logs."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-002-9fbfd7","check_id":"PAN-SEC-002","title":"Allow rule matches any application","category":"policy_hygiene","severity":"high","risk":{"exposure":5,"privilege":3,"impact":4,"control_gap":2,"score":120},"confidence":1,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Any-Any-Permit-All' allows application any, so App-ID does not constrain what protocol rides the permitted ports. Tunneling and protocol abuse are not blocked.","remediation":["Run a policy optimizer or traffic log review to list the applications actually seen on this rule.","Replace application any with that list, plus their implicit dependencies.","Set service to application-default once the applications are pinned."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-002-c29700","check_id":"PAN-SEC-002","title":"Allow rule matches any application","category":"policy_hygiene","severity":"high","risk":{"exposure":5,"privilege":3,"impact":4,"control_gap":2,"score":120},"confidence":1,"source":"deterministic","evidence":[{"object":"Legacy-Partner-Inbound","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound']","snippet":"<entry name=\"Legacy-Partner-Inbound\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any-ipv4</member></source>\n                  <destination><member>dmz-servers</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Kept from the 2019 build, source object looks specific but is not</description>\n                  <tag><member>legacy</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Legacy-Partner-Inbound' allows application any, so App-ID does not constrain what protocol rides the permitted ports. Tunneling and protocol abuse are not blocked.","remediation":["Run a policy optimizer or traffic log review to list the applications actually seen on this rule.","Replace application any with that list, plus their implicit dependencies.","Set service to application-default once the applications are pinned."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-003-7bcaac","check_id":"PAN-SEC-003","title":"Allow rule matches any service","category":"policy_hygiene","severity":"high","risk":{"exposure":5,"privilege":3,"impact":4,"control_gap":2,"score":120},"confidence":1,"source":"deterministic","evidence":[{"object":"Legacy-Partner-Inbound","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound']","snippet":"<entry name=\"Legacy-Partner-Inbound\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any-ipv4</member></source>\n                  <destination><member>dmz-servers</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Kept from the 2019 build, source object looks specific but is not</description>\n                  <tag><member>legacy</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Legacy-Partner-Inbound' allows service any, opening every TCP and UDP port for the matched applications instead of only the ports the service needs.","remediation":["Set service to application-default when the applications are known.","Otherwise attach explicit service objects for the ports in use."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 7.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-003-c6a6fd","check_id":"PAN-SEC-003","title":"Allow rule matches any service","category":"policy_hygiene","severity":"high","risk":{"exposure":5,"privilege":3,"impact":4,"control_gap":2,"score":120},"confidence":1,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Any-Any-Permit-All' allows service any, opening every TCP and UDP port for the matched applications instead of only the ports the service needs.","remediation":["Set service to application-default when the applications are known.","Otherwise attach explicit service objects for the ports in use."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 7.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-028-e88645","check_id":"PAN-SEC-028","title":"More superuser administrators than a small team needs","category":"platform_hardening","severity":"high","risk":{"exposure":3,"privilege":5,"impact":4,"control_gap":2,"score":120},"confidence":0.75,"source":"deterministic","evidence":[{"object":"admin","object_type":"admin_user","xpath":"/config/mgt-config/users/entry[@name='admin']","snippet":"","scope":"mgt-config"},{"object":"apiuser","object_type":"admin_user","xpath":"/config/mgt-config/users/entry[@name='apiuser']","snippet":"","scope":"mgt-config"},{"object":"backup-admin","object_type":"admin_user","xpath":"/config/mgt-config/users/entry[@name='backup-admin']","snippet":"","scope":"mgt-config"}],"risk_text":"3 administrator accounts hold the superuser role: admin, apiuser, backup-admin. Each one is a full compromise of the device if it is taken over, and most day to day work fits a narrower role.","remediation":["Move read-only users such as auditors and monitoring accounts to the superreader role.","Give API integrations a custom role limited to the calls they make.","Keep superuser for break-glass accounts only."],"limitations":["A small team may legitimately need several superusers. Reported as a review item."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-012-8029c2","check_id":"PAN-SEC-012","title":"Outbound internet rule without URL filtering","category":"security_profiles","severity":"high","risk":{"exposure":3,"privilege":3,"impact":4,"control_gap":3,"score":108},"confidence":0.85,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Any-Any-Permit-All' permits web traffic out to any with no URL filtering profile. Malware delivery domains, phishing pages and command and control URLs are not categorized or blocked, and no URL log is produced.","remediation":["Attach a URL filtering profile to the outbound rule.","Block the malware, command-and-control, phishing and newly-registered-domain categories.","Enable credential phishing prevention where User-ID is available."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 6.12","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-012-9c5bd5","check_id":"PAN-SEC-012","title":"Outbound internet rule without URL filtering","category":"security_profiles","severity":"high","risk":{"exposure":3,"privilege":3,"impact":4,"control_gap":3,"score":108},"confidence":0.85,"source":"deterministic","evidence":[{"object":"Outbound-Web","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Outbound-Web']","snippet":"<entry name=\"Outbound-Web\">\n                  <from><member>trust</member></from>\n                  <to><member>untrust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application>\n                    <member>web-browsing</member>\n                    <member>ssl</member>\n                  </application>\n                  <service><member>application-default</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>NoUrl-Profiles</member></group>\n                  </profile-setting>\n                  <description>Corporate internet browsing</description>\n                  <tag><member>egress</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Outbound-Web' permits web traffic out to untrust with no URL filtering profile. Malware delivery domains, phishing pages and command and control URLs are not categorized or blocked, and no URL log is produced.","remediation":["Attach a URL filtering profile to the outbound rule.","Block the malware, command-and-control, phishing and newly-registered-domain categories.","Enable credential phishing prevention where User-ID is available."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 6.12","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-002-0dd515","check_id":"PAN-SEC-002","title":"Allow rule matches any application","category":"policy_hygiene","severity":"high","risk":{"exposure":4,"privilege":3,"impact":4,"control_gap":2,"score":96},"confidence":1,"source":"deterministic","evidence":[{"object":"Temp-Vendor-Access-tmp","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp']","snippet":"<entry name=\"Temp-Vendor-Access-tmp\">\n                  <from><member>untrust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>partner-net</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <description>Temporary access for the vendor migration, remove after cutover</description>\n                  <tag><member>temporary</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Temp-Vendor-Access-tmp' allows application any, so App-ID does not constrain what protocol rides the permitted ports. Tunneling and protocol abuse are not blocked.","remediation":["Run a policy optimizer or traffic log review to list the applications actually seen on this rule.","Replace application any with that list, plus their implicit dependencies.","Set service to application-default once the applications are pinned."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-003-242568","check_id":"PAN-SEC-003","title":"Allow rule matches any service","category":"policy_hygiene","severity":"high","risk":{"exposure":4,"privilege":3,"impact":4,"control_gap":2,"score":96},"confidence":1,"source":"deterministic","evidence":[{"object":"Temp-Vendor-Access-tmp","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp']","snippet":"<entry name=\"Temp-Vendor-Access-tmp\">\n                  <from><member>untrust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>partner-net</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <description>Temporary access for the vendor migration, remove after cutover</description>\n                  <tag><member>temporary</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Temp-Vendor-Access-tmp' allows service any, opening every TCP and UDP port for the matched applications instead of only the ports the service needs.","remediation":["Set service to application-default when the applications are known.","Otherwise attach explicit service objects for the ports in use."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 7.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-017-74d134","check_id":"PAN-SEC-017","title":"Address group is very broad","category":"objects","severity":"high","risk":{"exposure":4,"privilege":3,"impact":4,"control_gap":2,"score":96},"confidence":1,"source":"deterministic","evidence":[{"object":"all-networks","object_type":"address_group","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='all-networks']","snippet":"","scope":"vsys1"},{"object":"Broad-Datacenter-Allow","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow']","snippet":"<entry name=\"Broad-Datacenter-Allow\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>all-networks</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Datacenter east west traffic</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Address group 'all-networks' contains a member that resolves to the whole internet. 1 enabled allow rule(s) reference it, so each of them is far broader than its rule text suggests.","remediation":["Remove any 0.0.0.0/0 or ::/0 member from the group.","Split oversized groups by function or environment.","Re-check every rule that references the group after the split."],"limitations":[],"cis_ref":null,"blast_radius":{"hosts":2,"services":1},"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-025-b1b01b","check_id":"PAN-SEC-025","title":"Bidirectional static source NAT creates an implicit inbound path","category":"nat_exposure","severity":"high","risk":{"exposure":4,"privilege":3,"impact":4,"control_gap":2,"score":96},"confidence":0.9,"source":"deterministic","evidence":[{"object":"SNAT-DB-Bidirectional","object_type":"nat_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='SNAT-DB-Bidirectional']","snippet":"<entry name=\"SNAT-DB-Bidirectional\">\n                  <from><member>trust</member></from>\n                  <to><member>untrust</member></to>\n                  <source><member>db-server</member></source>\n                  <destination><member>any</member></destination>\n                  <service>any</service>\n                  <nat-type>ipv4</nat-type>\n                  <to-interface>ethernet1/1</to-interface>\n                  <source-translation>\n                    <static-ip>\n                      <translated-address>203.0.113.50</translated-address>\n                      <bi-directional>yes</bi-directional>\n                    </static-ip>\n                  </source-translation>\n                  <description>Static NAT for the database replication link</description>\n                </entry>","scope":"vsys1"}],"risk_text":"NAT rule 'SNAT-DB-Bidirectional' uses bidirectional static source NAT to 203.0.113.50. PAN-OS creates the implicit reverse destination NAT, so the internal host is addressable from outside without an inbound NAT rule a reviewer would notice.","remediation":["Turn off bi-directional and write the inbound NAT explicitly if it is needed.","Make sure a security rule restricts the inbound direction."],"limitations":[],"cis_ref":null,"blast_radius":{"hosts":1,"services":65535},"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-013-38b00d","check_id":"PAN-SEC-013","title":"Allow rule without WildFire analysis","category":"security_profiles","severity":"high","risk":{"exposure":5,"privilege":2,"impact":4,"control_gap":2,"score":80},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Any-Any-Permit-All' permits file carrying applications with no WildFire analysis profile. Unknown files are never detonated, so novel malware is only stopped if a signature already exists.","remediation":["Attach a WildFire analysis profile that forwards all supported file types.","Confirm the WildFire license is active and the appliance can reach the cloud."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 5.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-013-868e54","check_id":"PAN-SEC-013","title":"Allow rule without WildFire analysis","category":"security_profiles","severity":"high","risk":{"exposure":5,"privilege":2,"impact":4,"control_gap":2,"score":80},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Legacy-Partner-Inbound","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound']","snippet":"<entry name=\"Legacy-Partner-Inbound\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any-ipv4</member></source>\n                  <destination><member>dmz-servers</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Kept from the 2019 build, source object looks specific but is not</description>\n                  <tag><member>legacy</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Legacy-Partner-Inbound' permits file carrying applications with no WildFire analysis profile. Unknown files are never detonated, so novel malware is only stopped if a signature already exists.","remediation":["Attach a WildFire analysis profile that forwards all supported file types.","Confirm the WildFire license is active and the appliance can reach the cloud."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 5.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-013-c98a32","check_id":"PAN-SEC-013","title":"Allow rule without WildFire analysis","category":"security_profiles","severity":"high","risk":{"exposure":5,"privilege":2,"impact":4,"control_gap":2,"score":80},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Inbound-Web-DMZ","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Inbound-Web-DMZ']","snippet":"<entry name=\"Inbound-Web-DMZ\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>web-server-1</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application>\n                    <member>web-browsing</member>\n                    <member>ssl</member>\n                  </application>\n                  <service>\n                    <member>service-http</member>\n                    <member>service-https</member>\n                  </service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Partial-Profiles</member></group>\n                  </profile-setting>\n                  <description>Publish the corporate web site</description>\n                  <tag><member>dmz</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Inbound-Web-DMZ' permits file carrying applications with no WildFire analysis profile. Unknown files are never detonated, so novel malware is only stopped if a signature already exists.","remediation":["Attach a WildFire analysis profile that forwards all supported file types.","Confirm the WildFire license is active and the appliance can reach the cloud."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 5.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-006-c07308","check_id":"PAN-SEC-006","title":"Temporary rule with no schedule or expiry","category":"policy_hygiene","severity":"medium","risk":{"exposure":4,"privilege":3,"impact":3,"control_gap":2,"score":72},"confidence":0.85,"source":"deterministic","evidence":[{"object":"Temp-Vendor-Access-tmp","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp']","snippet":"<entry name=\"Temp-Vendor-Access-tmp\">\n                  <from><member>untrust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>partner-net</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <description>Temporary access for the vendor migration, remove after cutover</description>\n                  <tag><member>temporary</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Temp-Vendor-Access-tmp' is marked as temporary but has no schedule attached, so the access it grants never expires on its own.","remediation":["Attach a schedule object with an end date to the rule.","Or set a calendar reminder and a tag with the removal date.","Review whether the access is still needed at all."],"limitations":["Matched on the rule name, description and tags. A permanent rule whose name contains a word like test will match."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-010-54fd82","check_id":"PAN-SEC-010","title":"Allow rule without any security profile","category":"security_profiles","severity":"medium","risk":{"exposure":2,"privilege":3,"impact":4,"control_gap":3,"score":72},"confidence":1,"source":"deterministic","evidence":[{"object":"Broad-Datacenter-Allow","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow']","snippet":"<entry name=\"Broad-Datacenter-Allow\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>all-networks</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Datacenter east west traffic</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Broad-Datacenter-Allow' allows traffic with no security profile group and no inline profiles. Nothing on this path is inspected for malware, exploits or command and control.","remediation":["Attach a security profile group to the rule.","If no suitable group exists, create one from the Palo Alto Networks best practice profiles.","Verify the group includes antivirus, anti-spyware, vulnerability protection and WildFire."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 6.7","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-014-25d575","check_id":"PAN-SEC-014","title":"No decryption policy covering outbound traffic","category":"security_profiles","severity":"medium","risk":{"exposure":3,"privilege":2,"impact":4,"control_gap":3,"score":72},"confidence":0.6,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"},{"object":"Outbound-Web","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Outbound-Web']","snippet":"<entry name=\"Outbound-Web\">\n                  <from><member>trust</member></from>\n                  <to><member>untrust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application>\n                    <member>web-browsing</member>\n                    <member>ssl</member>\n                  </application>\n                  <service><member>application-default</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>NoUrl-Profiles</member></group>\n                  </profile-setting>\n                  <description>Corporate internet browsing</description>\n                  <tag><member>egress</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"2 outbound rule(s) permit encrypted web traffic and no enabled decryption rule covers them. Threat prevention on those rules can only see the TLS handshake, so most inspection is nominal.","remediation":["Build a decryption policy for outbound sessions with an exclusion list for finance, health and privacy categories.","Roll it out to a pilot user group first and watch for application breakage.","Document the exclusions so the gap is a decision, not an accident."],"limitations":["Decryption may be performed by a separate device or be restricted by local law.","Confirm with the operator before treating this as a fault."],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 8.1","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-013-e554bf","check_id":"PAN-SEC-013","title":"Allow rule without WildFire analysis","category":"security_profiles","severity":"medium","risk":{"exposure":4,"privilege":2,"impact":4,"control_gap":2,"score":64},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Temp-Vendor-Access-tmp","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp']","snippet":"<entry name=\"Temp-Vendor-Access-tmp\">\n                  <from><member>untrust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>partner-net</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <description>Temporary access for the vendor migration, remove after cutover</description>\n                  <tag><member>temporary</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Temp-Vendor-Access-tmp' permits file carrying applications with no WildFire analysis profile. Unknown files are never detonated, so novel malware is only stopped if a signature already exists.","remediation":["Attach a WildFire analysis profile that forwards all supported file types.","Confirm the WildFire license is active and the appliance can reach the cloud."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 5.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-008-f46499","check_id":"PAN-SEC-008","title":"Rule does not log at session end","category":"policy_hygiene","severity":"medium","risk":{"exposure":5,"privilege":2,"impact":3,"control_gap":2,"score":60},"confidence":1,"source":"deterministic","evidence":[{"object":"Inbound-Mail","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Inbound-Mail']","snippet":"<entry name=\"Inbound-Mail\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>mail-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>smtp</member></application>\n                  <service><member>smtp-25</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>yes</log-start>\n                  <log-end>no</log-end>\n                  <profile-setting>\n                    <group><member>Strict-Profiles</member></group>\n                  </profile-setting>\n                  <description>Inbound SMTP to the mail relay</description>\n                  <tag><member>dmz</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Inbound-Mail' logs at session start only. Bytes transferred, session duration and the final App-ID verdict are never recorded.","remediation":["Enable log at session end.","Leave log at session start off unless you are troubleshooting."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-009-8830c1","check_id":"PAN-SEC-009","title":"Rule has no log forwarding profile","category":"policy_hygiene","severity":"medium","risk":{"exposure":5,"privilege":2,"impact":3,"control_gap":2,"score":60},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Inbound-Mail","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Inbound-Mail']","snippet":"<entry name=\"Inbound-Mail\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>mail-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>smtp</member></application>\n                  <service><member>smtp-25</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>yes</log-start>\n                  <log-end>no</log-end>\n                  <profile-setting>\n                    <group><member>Strict-Profiles</member></group>\n                  </profile-setting>\n                  <description>Inbound SMTP to the mail relay</description>\n                  <tag><member>dmz</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Inbound-Mail' logs locally but has no log forwarding profile, so its logs are lost when the local log partition wraps.","remediation":["Create a log forwarding profile pointing at your syslog or Cortex Data Lake collector.","Attach it to every logging rule, or set it as the default in the rule template."],"limitations":["A Panorama pushed log setting would not be visible in a firewall-only export."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-030-5c8e84","check_id":"PAN-SEC-030","title":"No syslog forwarding configured","category":"platform_hardening","severity":"medium","risk":{"exposure":2,"privilege":2,"impact":5,"control_gap":3,"score":60},"confidence":0.85,"source":"deterministic","evidence":[{"object":"log-settings","object_type":"log_settings","xpath":"/config/shared/log-settings","snippet":"","scope":"shared"}],"risk_text":"The firewall sends its logs to no syslog server. Logs stay on the appliance and are lost when the local partition wraps or the device is rebuilt, which removes the evidence an investigation depends on.","remediation":["Create a syslog server profile pointing at your collector, over TLS where possible.","Attach it to system, config and traffic log forwarding.","Verify events arrive at the collector."],"limitations":["Log forwarding may be configured in a Panorama template that is not part of this export."],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 1.1.1.1","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-032-bb6f53","check_id":"PAN-SEC-032","title":"SNMP v2c is enabled","category":"platform_hardening","severity":"medium","risk":{"exposure":3,"privilege":2,"impact":3,"control_gap":3,"score":54},"confidence":1,"source":"deterministic","evidence":[{"object":"deviceconfig/system/snmp-setting","object_type":"device_system","xpath":"/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system","snippet":"","scope":"localhost.localdomain"}],"risk_text":"SNMP v2c is enabled. The community string crosses the network in clear text and there is no encryption, so anyone who can read the traffic can poll the device for its interface, route and session tables.","remediation":["Switch the SNMP access setting to v3.","Configure authentication and privacy on the v3 user.","Restrict SNMP to the monitoring subnet with permitted IPs."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 1.5.1","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-002-39ca18","check_id":"PAN-SEC-002","title":"Allow rule matches any application","category":"policy_hygiene","severity":"medium","risk":{"exposure":2,"privilege":3,"impact":4,"control_gap":2,"score":48},"confidence":1,"source":"deterministic","evidence":[{"object":"Broad-Datacenter-Allow","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow']","snippet":"<entry name=\"Broad-Datacenter-Allow\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>all-networks</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Datacenter east west traffic</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Broad-Datacenter-Allow' allows application any, so App-ID does not constrain what protocol rides the permitted ports. Tunneling and protocol abuse are not blocked.","remediation":["Run a policy optimizer or traffic log review to list the applications actually seen on this rule.","Replace application any with that list, plus their implicit dependencies.","Set service to application-default once the applications are pinned."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-002-6ac6c3","check_id":"PAN-SEC-002","title":"Allow rule matches any application","category":"policy_hygiene","severity":"medium","risk":{"exposure":2,"privilege":3,"impact":4,"control_gap":2,"score":48},"confidence":1,"source":"deterministic","evidence":[{"object":"Catch-All-Internal","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Catch-All-Internal']","snippet":"<entry name=\"Catch-All-Internal\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Strict-Profiles</member></group>\n                  </profile-setting>\n                  <description>Internal catch all added during the 2023 outage</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Catch-All-Internal' allows application any, so App-ID does not constrain what protocol rides the permitted ports. Tunneling and protocol abuse are not blocked.","remediation":["Run a policy optimizer or traffic log review to list the applications actually seen on this rule.","Replace application any with that list, plus their implicit dependencies.","Set service to application-default once the applications are pinned."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-003-4cff17","check_id":"PAN-SEC-003","title":"Allow rule matches any service","category":"policy_hygiene","severity":"medium","risk":{"exposure":2,"privilege":3,"impact":4,"control_gap":2,"score":48},"confidence":1,"source":"deterministic","evidence":[{"object":"Broad-Datacenter-Allow","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow']","snippet":"<entry name=\"Broad-Datacenter-Allow\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>all-networks</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Datacenter east west traffic</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Broad-Datacenter-Allow' allows service any, opening every TCP and UDP port for the matched applications instead of only the ports the service needs.","remediation":["Set service to application-default when the applications are known.","Otherwise attach explicit service objects for the ports in use."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 7.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-003-9f87ee","check_id":"PAN-SEC-003","title":"Allow rule matches any service","category":"policy_hygiene","severity":"medium","risk":{"exposure":2,"privilege":3,"impact":4,"control_gap":2,"score":48},"confidence":1,"source":"deterministic","evidence":[{"object":"Catch-All-Internal","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Catch-All-Internal']","snippet":"<entry name=\"Catch-All-Internal\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Strict-Profiles</member></group>\n                  </profile-setting>\n                  <description>Internal catch all added during the 2023 outage</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Catch-All-Internal' allows service any, opening every TCP and UDP port for the matched applications instead of only the ports the service needs.","remediation":["Set service to application-default when the applications are known.","Otherwise attach explicit service objects for the ports in use."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 7.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-009-fa6379","check_id":"PAN-SEC-009","title":"Rule has no log forwarding profile","category":"policy_hygiene","severity":"medium","risk":{"exposure":4,"privilege":2,"impact":3,"control_gap":2,"score":48},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Temp-Vendor-Access-tmp","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp']","snippet":"<entry name=\"Temp-Vendor-Access-tmp\">\n                  <from><member>untrust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>partner-net</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <description>Temporary access for the vendor migration, remove after cutover</description>\n                  <tag><member>temporary</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Temp-Vendor-Access-tmp' logs locally but has no log forwarding profile, so its logs are lost when the local log partition wraps.","remediation":["Create a log forwarding profile pointing at your syslog or Cortex Data Lake collector.","Attach it to every logging rule, or set it as the default in the rule template."],"limitations":["A Panorama pushed log setting would not be visible in a firewall-only export."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-021-61fb57","check_id":"PAN-SEC-021","title":"Broad allow rule generalizes earlier specific rules","category":"rule_logic","severity":"medium","risk":{"exposure":2,"privilege":3,"impact":4,"control_gap":2,"score":48},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Catch-All-Internal","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Catch-All-Internal']","snippet":"<entry name=\"Catch-All-Internal\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Strict-Profiles</member></group>\n                  </profile-setting>\n                  <description>Internal catch all added during the 2023 outage</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Broad-Datacenter-Allow","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow']","snippet":"<entry name=\"Broad-Datacenter-Allow\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>all-networks</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Datacenter east west traffic</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Specific-DB-Admin-Access","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Specific-DB-Admin-Access']","snippet":"<entry name=\"Specific-DB-Admin-Access\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>db-admins</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>mssql-db</member></application>\n                  <service><member>application-default</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Strict-Profiles</member></group>\n                  </profile-setting>\n                  <description>DBA workstations to the database</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Specific-App-DB-Access","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Specific-App-DB-Access']","snippet":"<entry name=\"Specific-App-DB-Access\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>app-servers</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>mssql-db</member></application>\n                  <service><member>application-default</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Strict-Profiles</member></group>\n                  </profile-setting>\n                  <description>Application tier to the database</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Allow rule 'Catch-All-Internal' is broad enough to cover 3 earlier, more specific rules. Everything those rules were narrowing is permitted anyway, so the specificity above it does not constrain traffic.","remediation":["Narrow the broad rule to the applications, services and addresses actually required.","Or remove the specific rules it makes redundant, so the policy states its real intent."],"limitations":[],"cis_ref":null,"blast_radius":{"hosts":3,"services":1},"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-001-af6fe8","check_id":"PAN-SEC-001","title":"Allow rule matches any source and any destination","category":"policy_hygiene","severity":"medium","risk":{"exposure":2,"privilege":4,"impact":5,"control_gap":1,"score":40},"confidence":1,"source":"deterministic","evidence":[{"object":"Catch-All-Internal","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Catch-All-Internal']","snippet":"<entry name=\"Catch-All-Internal\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Strict-Profiles</member></group>\n                  </profile-setting>\n                  <description>Internal catch all added during the 2023 outage</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Catch-All-Internal' allows traffic from any source to any destination between zones trust and trust. Every host reachable on those zones can reach every other host the rule permits.","remediation":["Replace the any source with the address objects or groups that actually need access.","Replace the any destination with the specific servers or subnets being reached.","Re-test the rule with a policy match query before committing."],"limitations":["Whether the permitted paths are actually used cannot be proven without traffic logs."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-001-ce169c","check_id":"PAN-SEC-001","title":"Allow rule matches any source and any destination","category":"policy_hygiene","severity":"medium","risk":{"exposure":3,"privilege":3,"impact":4,"control_gap":1,"score":36},"confidence":1,"source":"deterministic","evidence":[{"object":"Outbound-Web","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Outbound-Web']","snippet":"<entry name=\"Outbound-Web\">\n                  <from><member>trust</member></from>\n                  <to><member>untrust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application>\n                    <member>web-browsing</member>\n                    <member>ssl</member>\n                  </application>\n                  <service><member>application-default</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>NoUrl-Profiles</member></group>\n                  </profile-setting>\n                  <description>Corporate internet browsing</description>\n                  <tag><member>egress</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Outbound-Web' allows traffic from any source to any destination between zones trust and untrust. Every host reachable on those zones can reach every other host the rule permits.","remediation":["Replace the any source with the address objects or groups that actually need access.","Replace the any destination with the specific servers or subnets being reached.","Re-test the rule with a policy match query before committing."],"limitations":["Whether the permitted paths are actually used cannot be proven without traffic logs."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-013-43fb3b","check_id":"PAN-SEC-013","title":"Allow rule without WildFire analysis","category":"security_profiles","severity":"medium","risk":{"exposure":2,"privilege":2,"impact":4,"control_gap":2,"score":32},"confidence":0.9,"source":"deterministic","evidence":[{"object":"Broad-Datacenter-Allow","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow']","snippet":"<entry name=\"Broad-Datacenter-Allow\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>all-networks</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Datacenter east west traffic</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Broad-Datacenter-Allow' permits file carrying applications with no WildFire analysis profile. Unknown files are never detonated, so novel malware is only stopped if a signature already exists.","remediation":["Attach a WildFire analysis profile that forwards all supported file types.","Confirm the WildFire license is active and the appliance can reach the cloud."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 5.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-019-479258","check_id":"PAN-SEC-019","title":"Rule is shadowed and can never match","category":"rule_logic","severity":"medium","risk":{"exposure":2,"privilege":2,"impact":4,"control_gap":2,"score":32},"confidence":0.95,"source":"deterministic","evidence":[{"object":"Block-Known-Bad-Sources","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Block-Known-Bad-Sources']","snippet":"<entry name=\"Block-Known-Bad-Sources\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>partner-net</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>deny</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Drop traffic from a partner range that was compromised</description>\n                  <tag><member>security</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Temp-Vendor-Access-tmp","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp']","snippet":"<entry name=\"Temp-Vendor-Access-tmp\">\n                  <from><member>untrust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>partner-net</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <description>Temporary access for the vendor migration, remove after cutover</description>\n                  <tag><member>temporary</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Temp-Vendor-Access-tmp' can never match: rule 'Block-Known-Bad-Sources', evaluated earlier in chain 'vsys1', already matches every packet it would match and takes action deny instead of allow. Traffic the later rule was written to permit is being denied.","remediation":["Compare the two rules and decide which action is correct.","Move the more specific rule above the broader one, or delete it.","Validate with a policy match test before committing."],"limitations":["Rules using negated addresses or dynamic address groups are skipped because containment cannot be proven from the rules alone."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-019-29d799","check_id":"PAN-SEC-019","title":"Rule is shadowed and can never match","category":"rule_logic","severity":"low","risk":{"exposure":2,"privilege":2,"impact":3,"control_gap":2,"score":24},"confidence":0.95,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"},{"object":"Deny-Guest-To-Prod","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Deny-Guest-To-Prod']","snippet":"<entry name=\"Deny-Guest-To-Prod\">\n                  <from><member>untrust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>deny</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Guests must never reach the database</description>\n                  <tag><member>security</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Deny-Guest-To-Prod' can never match: rule 'Any-Any-Permit-All', evaluated earlier in chain 'vsys1', already matches every packet it would match and takes action allow instead of deny. The later rule is dead configuration.","remediation":["Compare the two rules and decide which action is correct.","Move the more specific rule above the broader one, or delete it.","Validate with a policy match test before committing."],"limitations":["Rules using negated addresses or dynamic address groups are skipped because containment cannot be proven from the rules alone."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-031-edf9c7","check_id":"PAN-SEC-031","title":"No NTP server configured","category":"platform_hardening","severity":"low","risk":{"exposure":2,"privilege":1,"impact":4,"control_gap":3,"score":24},"confidence":1,"source":"deterministic","evidence":[{"object":"deviceconfig/system/ntp-servers","object_type":"device_system","xpath":"/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system","snippet":"","scope":"localhost.localdomain"}],"risk_text":"The device takes its time from no NTP server, so its clock drifts and log timestamps stop lining up with every other system during an investigation and certificate validation can fail without an obvious cause.","remediation":["Configure a primary and a secondary NTP server under deviceconfig system.","Use authenticated NTP where your infrastructure supports it."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 1.6.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-005-c8aab5","check_id":"PAN-SEC-005","title":"Rule has no description and no tag","category":"policy_hygiene","severity":"low","risk":{"exposure":1,"privilege":2,"impact":2,"control_gap":2,"score":8},"confidence":1,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Any-Any-Permit-All' has no description and no tag, so there is no recorded owner or business reason. Nobody can safely remove it during a cleanup.","remediation":["Add a description naming the business service and the requester.","Add a tag for the owning team or the change ticket."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-015-49946b","check_id":"PAN-SEC-015","title":"Duplicate address objects with the same value","category":"objects","severity":"info","risk":{"exposure":1,"privilege":1,"impact":3,"control_gap":2,"score":6},"confidence":1,"source":"deterministic","evidence":[{"object":"web-server-1","object_type":"address_object","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address/entry[@name='web-server-1']","snippet":"","scope":"vsys1"},{"object":"web-server-dup","object_type":"address_object","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address/entry[@name='web-server-dup']","snippet":"","scope":"vsys1"}],"risk_text":"2 address objects hold the same ip-netmask value 10.20.0.10/32: web-server-1, web-server-dup. Editing one of them leaves the others behind, so rules that look equivalent quietly stop being equivalent.","remediation":["Pick the canonical object name.","Repoint every rule and group that references the duplicates.","Delete the duplicates once no references remain."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-004-e03798","check_id":"PAN-SEC-004","title":"Disabled rule left in the rulebase","category":"policy_hygiene","severity":"info","risk":{"exposure":1,"privilege":2,"impact":2,"control_gap":1,"score":4},"confidence":1,"source":"deterministic","evidence":[{"object":"Old-Guest-Wifi-Rule","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Old-Guest-Wifi-Rule']","snippet":"<entry name=\"Old-Guest-Wifi-Rule\">\n                  <from><member>trust</member></from>\n                  <to><member>untrust</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <disabled>yes</disabled>\n                  <log-end>yes</log-end>\n                  <description>Legacy guest wifi rule, disabled during the 2024 redesign</description>\n                  <tag><member>legacy</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Old-Guest-Wifi-Rule' is disabled but still present. If it is re-enabled by mistake it would allow any from trust to untrust.","remediation":["Confirm with the rule owner that the rule is no longer needed.","Export the rule for the change record, then delete it.","If it is a staged rule, tag it and record the date it should be enabled or removed."],"limitations":[],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-020-183cda","check_id":"PAN-SEC-020","title":"Rule is redundant","category":"rule_logic","severity":"info","risk":{"exposure":1,"privilege":1,"impact":2,"control_gap":2,"score":4},"confidence":0.95,"source":"deterministic","evidence":[{"object":"Broad-Datacenter-Allow","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow']","snippet":"<entry name=\"Broad-Datacenter-Allow\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>all-networks</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Datacenter east west traffic</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Specific-App-DB-Access","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Specific-App-DB-Access']","snippet":"<entry name=\"Specific-App-DB-Access\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>app-servers</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>mssql-db</member></application>\n                  <service><member>application-default</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Strict-Profiles</member></group>\n                  </profile-setting>\n                  <description>Application tier to the database</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Specific-App-DB-Access' is fully covered by the earlier rule 'Broad-Datacenter-Allow' in chain 'vsys1' and takes the same action (allow), so it never changes the outcome.","remediation":["Confirm no logging or profile difference justifies keeping both rules.","Delete the redundant rule."],"limitations":["The two rules do not attach the same security profiles."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-020-47b163","check_id":"PAN-SEC-020","title":"Rule is redundant","category":"rule_logic","severity":"info","risk":{"exposure":1,"privilege":1,"impact":2,"control_gap":2,"score":4},"confidence":0.95,"source":"deterministic","evidence":[{"object":"Any-Any-Permit-All","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All']","snippet":"<entry name=\"Any-Any-Permit-All\">\n                  <from><member>untrust</member></from>\n                  <to><member>any</member></to>\n                  <source><member>any</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-start>no</log-start>\n                  <log-end>no</log-end>\n                </entry>","scope":"vsys1"},{"object":"Legacy-Partner-Inbound","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound']","snippet":"<entry name=\"Legacy-Partner-Inbound\">\n                  <from><member>untrust</member></from>\n                  <to><member>dmz</member></to>\n                  <source><member>any-ipv4</member></source>\n                  <destination><member>dmz-servers</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Kept from the 2019 build, source object looks specific but is not</description>\n                  <tag><member>legacy</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Legacy-Partner-Inbound' is fully covered by the earlier rule 'Any-Any-Permit-All' in chain 'vsys1' and takes the same action (allow), so it never changes the outcome.","remediation":["Confirm no logging or profile difference justifies keeping both rules.","Delete the redundant rule."],"limitations":["The two rules log differently, which may be why both exist."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-020-970784","check_id":"PAN-SEC-020","title":"Rule is redundant","category":"rule_logic","severity":"info","risk":{"exposure":1,"privilege":1,"impact":2,"control_gap":2,"score":4},"confidence":0.95,"source":"deterministic","evidence":[{"object":"Broad-Datacenter-Allow","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow']","snippet":"<entry name=\"Broad-Datacenter-Allow\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>all-networks</member></source>\n                  <destination><member>any</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>any</member></application>\n                  <service><member>any</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <description>Datacenter east west traffic</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"},{"object":"Specific-DB-Admin-Access","object_type":"security_rule","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Specific-DB-Admin-Access']","snippet":"<entry name=\"Specific-DB-Admin-Access\">\n                  <from><member>trust</member></from>\n                  <to><member>trust</member></to>\n                  <source><member>db-admins</member></source>\n                  <destination><member>db-server</member></destination>\n                  <source-user><member>any</member></source-user>\n                  <application><member>mssql-db</member></application>\n                  <service><member>application-default</member></service>\n                  <category><member>any</member></category>\n                  <action>allow</action>\n                  <log-end>yes</log-end>\n                  <log-setting>default-forwarding</log-setting>\n                  <profile-setting>\n                    <group><member>Strict-Profiles</member></group>\n                  </profile-setting>\n                  <description>DBA workstations to the database</description>\n                  <tag><member>datacenter</member></tag>\n                </entry>","scope":"vsys1"}],"risk_text":"Rule 'Specific-DB-Admin-Access' is fully covered by the earlier rule 'Broad-Datacenter-Allow' in chain 'vsys1' and takes the same action (allow), so it never changes the outcome.","remediation":["Confirm no logging or profile difference justifies keeping both rules.","Delete the redundant rule."],"limitations":["The two rules do not attach the same security profiles."],"cis_ref":null,"blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-033-37f153","check_id":"PAN-SEC-033","title":"No login banner configured","category":"platform_hardening","severity":"info","risk":{"exposure":1,"privilege":1,"impact":2,"control_gap":2,"score":4},"confidence":1,"source":"deterministic","evidence":[{"object":"deviceconfig/system/login-banner","object_type":"device_system","xpath":"/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system","snippet":"","scope":"localhost.localdomain"}],"risk_text":"The device shows no login banner. Several audit regimes require an authorized-use notice to be displayed before administrative access is granted.","remediation":["Set a login banner under deviceconfig system with your authorized-use notice.","Have legal review the wording once."],"limitations":[],"cis_ref":"CIS Palo Alto Firewall 11 Benchmark v1.2.0 1.1.2","blast_radius":null,"ai":null,"feedback":null,"detail_hidden":false},{"finding_id":"PAN-SEC-016-23daa1","check_id":"PAN-SEC-016","title":"Object is defined but never referenced","category":"objects","severity":"info","risk":{"exposure":1,"privilege":1,"impact":1,"control_gap":1,"score":1},"confidence":0.8,"source":"deterministic","evidence":[{"object":"web-server-dup","object_type":"address_object","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address/entry[@name='web-server-dup']","snippet":"","scope":"vsys1"},{"object":"orphan-host","object_type":"address_object","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address/entry[@name='orphan-host']","snippet":"","scope":"vsys1"},{"object":"orphan-svc","object_type":"service_object","xpath":"/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/service/entry[@name='orphan-svc']","snippet":"","scope":"vsys1"}],"risk_text":"3 object(s) are defined but never referenced by any rule or group. They enlarge the config, slow commits and often mark a decommission left half done.","remediation":["Confirm the object is not referenced from another vsys, device group or template.","Delete it, or tag it for a scheduled cleanup."],"limitations":["References from another vsys, device group or Panorama template sit outside this check."],"cis_ref":null,"blast_radius":{"hosts":0,"services":3},"ai":null,"feedback":null,"detail_hidden":false}],"passed_checks":[],"limitations":["This review reads the configuration only. It cannot see traffic logs, so it cannot say which permitted paths are actually used.","Internet exposure is inferred from zone names and address breadth, not from routing tables.","This is a firewall export. Objects, rules and log settings inherited from Panorama may not appear in it."],"visibility":{"detail_limit":null},"error_code":null},"generated_at":"2026-10-31T12:00:00+00:00","locale":"en","brand":{"name":"ConfigProof","logo_url":"/brand/configproof-mark.svg","white_label":null},"executive_summary":"This firewall running PAN-OS 11.1.0 scored 0 out of 100. The review examined 15 security rules, 4 NAT rules and 18 objects, and produced 63 findings: 16 critical, 19 high, 18 medium, 3 low and 7 informational. The critical findings are the ones to act on this week; each one describes a path that is open right now.","top_actions":["critical: Inbound internet rule without threat prevention (4 affected)","critical: Allow rule without any security profile (3 affected)","critical: Allow rule matches any source and any destination (2 affected)","critical: Inbound destination NAT without a restrictive security rule (2 affected)","critical: Well known administrator account is active with full privilege (2 affected)"],"methodology":"ConfigProof parses the uploaded PAN-OS configuration into a normalized object model, then runs every check in rule pack PAN-BP-0.1.0 against it. Each check is deterministic code: it either finds the pattern in the configuration or it does not. Risk is scored as exposure times privilege times impact times control gap, on a 375-point scale, and mapped to severity bands (critical at 150, high at 75, medium at 30, low at 8). Confidence is a separate axis: 1.00 means the configuration alone proves the finding, and anything below 0.50 is reported as an observation rather than a defect. Every finding carries the exact xpath of the object it describes. The language model, when enabled, only rewrites the narrative and the executive summary. It never creates a finding, never changes a severity and never sees the raw configuration."}