Log Forwarding Profile not selected for a Palo Alto Networks device security policy rule misconfigur

Rule Details

Cortex AppSec Rule ID	APPSEC_PAN_9
Category - Subcategory	Public Exposure - Ingress Controls
Provider	OTHER
Severity	LOW
Framework	Ansible

Impact

This rule detects whether all security policy rules in Palo Alto Networks devices are associated with a Log Forwarding Profile. These profiles are essential for monitoring, troubleshooting, and auditing, as they determine which logs are forwarded and their destination for analysis and storage.

How to Fix

Palo Alto Networks

• Resource: panos_security_rule
• Attribute: log_setting

To mitigate this issue, ensure that the log_setting attribute in your panos_security_rule resources is defined, and points to an existing Log Forwarding Profile. This setup ensures that activity logs for each rule are captured and forwarded correctly, facilitating effective monitoring and analysis.

Secure Code Example:

- name: Example
  tasks:
    - name: Example
      paloaltonetworks.panos.panos_security_rule:
        ...
+        log_setting: 'default'

In this example, configuring the log_setting attribute with a valid Log Forwarding Profile name for each security rule ensures that logging is properly implemented for security monitoring and analysis.