PAN-OS - DNS Sinkhole

[idovandijk]

Status

Ready

Related Issues

fixes: https://jira-hq.paloaltonetworks.local/browse/CIAC-2793

Description

• Added a new playbook that creates a DNS sinkhole using PAN-OS NGFW.
• Added a new playbook that adds an anti-spyware security profile to a rule in a safe manner and outputs the profile that is applied to the rule at the end of the playbook execution.
• Added a test playbook for the playbook that adds an anti-spyware profile to a rule.

Screenshots

Minimum version of Cortex XSOAR

6.8.0

Does it break backward compatibility?

No

[tomer-pan]

@idovandijk Great work!

Please review my comments:

• In policy match, maybe use "application" instead of "destination-port"
• SecurityProfileName - Maybe don't allow overwriting
• Get the tags of the existing rules - should only be run on the rules found from the policy match
• PAN-OS - Add Anti-Spyware Security Profile To Rule - description of output says "rule" instead of profile
• When creating a rule manually, need to apply the profile to it too
• PAN-OS - Add Anti Spyware playbook - under "Apply Profile", verify the context path
• Support multiple DNS signatures as inputs

[AdiPeret]

Comments below

…

On Thu, Jul 20, 2023 at 2:24 PM Tomer Haimof ***@***.***> wrote: @idovandijk <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_idovandijk&d=DwMCaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=LXy0iyJk4zhBMTIydnGZPhToo5BEyeLQVUhWjLnby1U&m=VvHZNYwlrb4ay3TU9RBq5gYUHViwmmSHyjO5IdHwvqjwnJsgu4mdhm0C2ybQAp8o&s=alUeMEFtk5fwOYgSRfzdcV2T3cTKgphHC_471Dy2Kyc&e=> Great work! Please review my comments: - In policy match, maybe use "application" instead of "destination-port" - Good idea, using application will allow you to detect the application layer and not relay on a dst port which can be easly changed. - SecurityProfileName - Maybe don't allow overwriting - Get the tags of the existing rules - should only be run on the rules found from the policy match - PAN-OS - Add Anti-Spyware Security Profile To Rule - description of output says "rule" instead of profile - Agree - When creating a rule manually, need to apply the profile to it too - PAN-OS - Add Anti Spyware playbook - under "Apply Profile", verify the context path - Agree - Support multiple DNS signatures as inputs — Reply to this email directly, view it on GitHub <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_demisto_content_pull_27700-23issuecomment-2D1643748885&d=DwMCaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=LXy0iyJk4zhBMTIydnGZPhToo5BEyeLQVUhWjLnby1U&m=VvHZNYwlrb4ay3TU9RBq5gYUHViwmmSHyjO5IdHwvqjwnJsgu4mdhm0C2ybQAp8o&s=bDlmEqv1PoKLVvYMHcR1-mN5_Q5iKPO8UNAM6W-_t2M&e=>, or unsubscribe <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_A7CACC6PWF2ABKWAS5VHYP3XREIQNANCNFSM6AAAAAAZTGGXIQ&d=DwMCaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=LXy0iyJk4zhBMTIydnGZPhToo5BEyeLQVUhWjLnby1U&m=VvHZNYwlrb4ay3TU9RBq5gYUHViwmmSHyjO5IdHwvqjwnJsgu4mdhm0C2ybQAp8o&s=AchlAMq1awv_7_ZPd-m_VpLPyJV5gMVTVpUbmgNDHlo&e=> . You are receiving this because your review was requested.Message ID: ***@***.***>

[melamedbn]

The conditional task is a bit confusing, you're asking if something is available but all of the options aren't related to the quest itself, or might be related but the title is missing context.

[idovandijk]

PR is ready for merge and waiting for tech docs

[ShirleyDenkberg]

Suggested change

	Checks whether the rule can have the anti spyware profile applied to it.
	Checks whether the rule can have the anti-spyware profile applied to it.

[ShirleyDenkberg]

Suggested change

	2. It has a profile, but it should not be overwritten with a new anti spyware profile.
	2. It has a profile, but it should not be overwritten with a new anti-spyware profile.

[ShirleyDenkberg]

Suggested change

	4. It has a security profile group, but the anti-spyware profile can be applied only if the group doesn't already have an anti spyware profile in it.
	4. It has a security profile group, but the anti-spyware profile can be applied only if the group doesn't already have an anti-spyware profile in it.

[ShirleyDenkberg]

Suggested change

	description: Please modify the security profile group, and add the Anti-Spyware security profile called ${inputs.SecurityProfileName}. If there's already an anti-spyware security profile configured there, please overwrite it.
	description: Modify the security profile group, and add the Anti-Spyware security profile called ${inputs.SecurityProfileName}. If there's already an anti-spyware security profile configured there, overwrite it.

[ShirleyDenkberg]

Suggested change

	https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
	https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Automations

[ShirleyDenkberg]

@melamedbn @michalgold @AdiPeret @ostolero @tomer-pan Doc review completed.