Workflow to Best Incorporate New and Modified App-IDs

1. Align your business needs with an approach to deploying Application and Threat content updates.

   Learn how Applications and Threat Content Updates work, and identify your organization as either mission-critical or security-first. Understanding which of these is most important to your business will help you to decide how to best deploy content updates and apply best practices to meet your business needs. You might find that you want to apply a mix of both approaches, perhaps depending on firewall deployment (data center or perimeter) or office location (remote or headquarters).
2. Review and apply the Best Practices for Applications and Threats Content Updates based on your organization’s network security and application availability requirements.
3. (PAN-OS 12.1.5 and later) Consider enabling App-ID Safeguard to maintain security policy intent. In certain cases where an App-ID gets modified, or a new one is introduced that supersedes a current App-ID, your security policy might inadvertently block certain content. When this is enabled, your security policy will continue to make policy decisions based on the previous App-ID. This means that a new App-ID that has associated previous App-IDs that are allowed, regardless of whether or not they are in separate rules, the new App-ID would also be automatically allowed. Keep in mind, the Previous App-ID attribute used to define the previously used application defintion gets reset with the next content release update.
4. Configure a security policy rule to always allow new App-IDs that might have network-wide impact, like authentication or software development applications.

   The New App-ID characteristic matches to only the App-IDs introduced in the latest content release. When used in a security policy, this gives you a month’s time to fine tune your security policy based on new App-IDs while ensuring constant availability for App-IDs that fall into critical categories (Ensure Critical New App-IDs are Allowed).
5. Set the schedule to Deploy Application and Threat Content Updates; this includes the option to delay new App-ID installation until you’ve had time to make necessary security policy updates (using the New App-ID Threshold).
6. After you’ve setup a content updates installation schedule, you’ll want to regularly check in and See the New and Modified App-IDs in a Content Release.
7. You can then See How New and Modified App-IDs Impact Your Security Policy, and make adjustments to your security policy as needed.
8. Monitor New App-IDs to get a view into new App-ID activity on your network, so that you’re best equipped to make the most effective security policy updates.