>
    Strata Copilot
    Create Advanced IP Defense Policy Rules
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced IP Defense
    3. Create Advanced IP Defense Policy Rules
    Download PDF
    Advanced IP Defense

    Create Advanced IP Defense Policy Rules

    Table of Contents

    Create Advanced IP Defense Policy Rules

    Create policy rules in an Advanced IP Defense profile to enforce security actions based on IP attributes and direct-to-IP detection.
    Where Can I Use This?What Do I Need?
    • PAN-OS 12.2.3 and later
    • Strata Cloud Manager
    • Advanced IP Defense license
    • Admin access to firewall or Strata Cloud Manager
    • Advanced IP Defense profile created
    Advanced IP Defense policy rules define how the firewall evaluates and acts on traffic based on real-time IP intelligence. Each rule lives inside an Advanced IP Defense profile that you attach to a security zone. When the firewall processes a connection, it queries Advanced IP Defense for the destination (or source) IP's attributes and evaluates each rule in order until a match occurs. This model lets you build a layered, zero trust approach to IP-based traffic rather than relying on static block lists.
    Rules match traffic against IP attributes organized into seven categories: Anonymizers, Association, Abuse, Malware-C2, High-Risk, Direct-to-IP, and Vulnerable. Some categories support selecting the entire category as a match condition, while others require you to select at least one specific attribute. For example, you can match all Anonymizers traffic as a group or target only Tor Exit Node and Open Proxy individually. Association requires you to select specific attributes such as AWS Cloud or Residential ISP because the category is too broad to block as a whole. Direct-to-IP has no individual attributes and can only be selected as a category. For the complete list of available attributes by category, see IP Attributes and Categories.
    Each rule specifies an IP match field (source IP or destination IP), one or more match conditions (maximum 8 per rule) using the Matches or Does not Match operator, an action — Allow (Permit), Alert (Permit and Log), Block (Drop & Log), or Deny (Drop) — and a log severity level. Multiple conditions in a single rule are evaluated with AND logic; multiple attributes within a condition are evaluated with OR logic. Rules within a profile are evaluated top-down — the first matching rule determines the action. To create OR logic across different categories, use separate rules. A profile can contain up to 64 rules. The log severity level determines how the resulting threat log entry is classified in your logging infrastructure and SIEM. Higher severity levels trigger more prominent alerts in log viewers and can be used to drive automated responses through log forwarding profiles and external integrations. Choose a severity level that reflects the confidence and risk associated with the match criteria.
    Rule configuration: operation, category, and attribute selection
    • Critical—Reserved for rules that match the highest-confidence, most dangerous threat indicators where immediate action is required. Use for confirmed active command-and-control infrastructure, known botnet controllers, or IP addresses associated with ongoing targeted attacks. Critical log entries typically trigger immediate SOC escalation and automated containment workflows.
    • High—Appropriate for rules that match high-confidence threat categories with a strong likelihood of malicious intent. Use for Malware C2 infrastructure, known exploit servers, and IPs associated with active data exfiltration. High severity entries warrant priority investigation and may trigger automated blocking at upstream network devices.
    • Medium—Suitable for rules that match indicators with moderate confidence or categories that may include both malicious and legitimate traffic. Use for anonymizer and proxy services, high-risk IP ranges, or direct-to-IP connections that could indicate either evasion techniques or legitimate application behavior. Medium severity entries are reviewed during routine threat hunting and triage.
    • Low—Used for rules that provide situational awareness without indicating a confirmed threat. Use for broad netblock owner monitoring, traffic to hosting providers, or connections to IP ranges associated with vulnerable services. Low severity entries support trend analysis and long-term threat intelligence without generating alert fatigue.
    • Informational—Used for visibility-only rules where the match criteria is unlikely to represent a threat but the traffic pattern is worth recording. Use for monitoring baseline traffic to cloud infrastructure, CDN providers, or residential ISP ranges. Informational entries support capacity planning, policy tuning, and false positive analysis without triggering any alert or response workflow.
    You can combine attributes across categories to create precise conditions. For example, a rule with two conditions — one that Matches Malware-C2 and another that Matches Direct-to-IP — blocks malware that connects to hardcoded command-and-control IPs without DNS resolution. A rule that Matches Public Cloud but Does not Match AWS Cloud alerts on traffic to non-AWS cloud infrastructure. The Does not Match operator is useful for carving out exceptions to broad category-level rules without needing a separate allowlist entry.
    Advanced IP Defense ships with three predefined profiles that provide baseline protection: default (all categories set to Alert), best-practice outbound (Destination IP, mix of Block and Alert), and best-practice inbound (Source IP, mix of Block and Alert). You can use a predefined profile as-is for immediate protection or clone it as a starting point for custom profiles tailored to your environment. All categories and attributes, including their IDs and metadata, are delivered through content package updates so that new attributes become available without requiring a PAN-OS upgrade.

    Create Advanced IP Defense Policy Rules in Strata Cloud Manager

    Create policy rules within an Advanced IP Defense profile in Strata Cloud Manager to enforce security policies based on IP attributes and direct-to-IP detection.
    Policy rules within an Advanced IP Defense profile define how the managed firewalls enforce security policies based on IP attributes and direct-to-IP detection. Each rule specifies match conditions using the Matches or Does not Match operator, an action, and a log severity level.
    1. Log in to Strata Cloud Manager.
    2. Select ConfigurationSecurity ServicesAdvanced IP Defense to access your Advanced IP Defense profiles.
    3. Select the Advanced IP Defense profile where you want to create the policy rule.
      Click on the profile name to open the profile configuration.
    4. Select the policy rules section.
      Select Policy Rules to view existing policy rules and create new ones.
    5. Click Add to create a new policy rule.
      A new policy rule entry is created with default settings.
    6. Configure the match criteria for the policy rule.
      Add one or more match conditions. For each condition, select a category and attribute, then choose the Matches or Does not Match operator. For the list of available categories and attributes, see IP Attributes and Categories.
      Multiple conditions in a single rule are evaluated with AND logic. Multiple attributes within a condition are evaluated with OR logic.
    7. Define the action for the policy rule.
      Choose the action to take when traffic matches the rule:
      • Allow (Permit)—Permit the traffic without logging
      • Alert (Permit and Log)—Permit the traffic and generate a log entry
      • Block (Drop & Log)—Drop the traffic and generate a log entry
      • Deny (Drop)—Drop the traffic without logging
    8. Configure log severity for the policy rule.
      Select the log severity level to control how the rule match appears in your threat logs and SIEM:
      • Critical—Highest-confidence, most dangerous threat indicators where immediate action is required. Use for confirmed active command-and-control infrastructure, known botnet controllers, or IP addresses associated with ongoing targeted attacks.
      • High—High-confidence threat categories with a strong likelihood of malicious intent. Use for Malware C2 infrastructure, known exploit servers, and IPs associated with active data exfiltration.
      • Medium—Moderate confidence indicators that may include both malicious and legitimate traffic. Use for anonymizer and proxy services, high-risk IP ranges, or direct-to-IP connections that could indicate evasion techniques.
      • Low—Situational awareness without a confirmed threat. Use for broad netblock owner monitoring, traffic to hosting providers, or connections to IP ranges associated with vulnerable services.
      • Informational—Visibility-only rules where the match criteria is unlikely to represent a threat but the traffic pattern is worth recording. Use for monitoring baseline traffic to cloud infrastructure, CDN providers, or residential ISP ranges.
    9. Save the policy rule.
    10. Push your changes.

    Create Advanced IP Defense Policy Rules in PAN-OS and Panorama

    Create policy rules within an Advanced IP Defense profile in PAN-OS and Panorama to enforce security policies based on IP attributes and direct-to-IP detection.
    Policy rules within an Advanced IP Defense profile define how the firewall enforces security policies based on IP attributes and direct-to-IP detection. Each rule specifies match conditions using the Matches or Does not Match operator, an action, and a log severity level.
    1. Log in to the PAN-OS web interface.
    2. Select ObjectsSecurity ServicesAdvanced IP Defense to access your Advanced IP Defense.
    3. Select the Advanced IP Defense profile where you want to create the policy rule.
      Click the profile name to open the profile configuration.
    4. Select the policy rules section.
      Select Policy Rules to view existing policy rules and create new ones.
      Profile rules list
    5. Click Add to create a new policy rule.
      A new policy rule entry is created with default settings.
    6. Configure the match criteria for the policy rule.
      Add one or more match conditions. For each condition, select a category and attribute, then choose the Matches or Does not Match operator. For the list of available categories and attributes, see IP Attributes and Categories.
      Multiple conditions in a single rule are evaluated with AND logic. Multiple attributes within a condition are evaluated with OR logic.
      Add Rule dialog
    7. Define the action for the policy rule.
      Choose the action to take when traffic matches the rule:
      • Allow (Permit)—Permit the traffic without logging
      • Alert (Permit and Log)—Permit the traffic and generate a log entry
      • Block (Drop & Log)—Drop the traffic and generate a log entry
      • Deny (Drop)—Drop the traffic without logging
    8. Configure log severity for the policy rule.
      Select the log severity level to control how the rule match appears in your threat logs and SIEM:
      • Critical—Highest-confidence, most dangerous threat indicators where immediate action is required. Use for confirmed active command-and-control infrastructure, known botnet controllers, or IP addresses associated with ongoing targeted attacks.
      • High—High-confidence threat categories with a strong likelihood of malicious intent. Use for Malware C2 infrastructure, known exploit servers, and IPs associated with active data exfiltration.
      • Medium—Moderate confidence indicators that may include both malicious and legitimate traffic. Use for anonymizer and proxy services, high-risk IP ranges, or direct-to-IP connections that could indicate evasion techniques.
      • Low—Situational awareness without a confirmed threat. Use for broad netblock owner monitoring, traffic to hosting providers, or connections to IP ranges associated with vulnerable services.
      • Informational—Visibility-only rules where the match criteria is unlikely to represent a threat but the traffic pattern is worth recording. Use for monitoring baseline traffic to cloud infrastructure, CDN providers, or residential ISP ranges.
    9. Save the policy rule configuration.
    10. Commit your changes.

    © 2026 Palo Alto Networks, Inc. All rights reserved.