Use Auto-Tagging to Automate Security Actions

Configure the firewall or Panorama to automatically tag policy objects and automate security actions.
Auto-tagging allows the firewall or Panorama to tag a policy object when it receives a log that matches specific criteria and establish IP address-to-tag or user-to-tag mapping. For example, when the firewall generates a threat log, you can configure the firewall to tag the source IP address or source user in the threat log with a specific tag name. You can then use these tags to automatically populate policy objects such as dynamic user groups or dynamic address groups, which can then be used to automate security actions in security, authentication, or decryption policies. For example, when you create a filter for the URL logs for
yes
in the
Credential Detected
column, you can apply a tag to the user that enforces an authentication policy that requires user to authenticate using multi-factor authentication (MFA).
Redistribute the mappings across your network by registering the IP address-to-tag and user-to-tag mappings to a PAN-OS integrated User-ID agent on the firewall or Panorama or to a remote User-ID agent using an HTTP server profile. The firewall can automatically remove (unregister) a tag associated with an IP address or user when you configure a timeout as part of a built-in action for a log forwarding profile or as part of log forwarding settings. For example, if the firewall detects a user has potentially compromised credentials, you could configure the firewall to require MFA authentication for that user for a given period of time, then configure a timeout to remove the user from the MFA requirement group.
  1. Depending on the type of log you want to use for tagging, create a log forwarding profile or configure the log settings to define how you want the firewall or Panorama to handle logs.
    • For Authentication, Data, Threat, Traffic, Tunnel Inspection, URL, and WildFire logs, create a log forwarding profile.
    • For User-ID, HIP Match, GlobalProtect, and IP-Tag logs, configure the log settings.
  2. Define the match list criteria that determine when the firewall or Panorama adds the tag to the policy object.
    For example, you can use a filter to configure a threshold or define a value (such as
    user eq “unknown”
    to identify users that the firewall has not yet mapped); when the firewall reaches that threshold or finds that value, the firewall adds the tag.
    • To create a log forwarding profile,
      Add
      it and select the
      Log Type
      you want to monitor for match list criteria (
      Objects
      Log Forwarding
      ).
    • To configure log settings,
      Add
      the log settings for the type of log you want to monitor for match list criteria (
      Device
      Log Settings
      ).
  3. Copy and paste a
    Filter
    value or use the
    Filter Builder
    to define the match criteria for the tag.
  4. Add a built-in action to tag the policy object.
    1. Add
      the
      Built-in Actions
      you want the firewall or Panorama to take when the logs contain an entry that meets the match list criteria.
    2. Name
      the action.
    3. Select the type of
      Target
      that you want to tag (
      Destination Address
      ,
      Source Address
      ,
      User
      , or
      X-Forwarded-For Address
      ).
    4. Confirm that
      Add Tag
      is the
      Action
      .
    5. Select the
      Registration
      source for the tag to determine how the firewall or Panorama redistributes the IP address-to-tag mapping.
      • Local User-ID
        —Redistribute the IP address-to-tag mapping on the User-ID agent on the firewall or Panorama.
      • Panorama User-ID
        —Redistribute the IP address-to-tag mapping on Panorama.
      • Remote User-ID
        —Redistribute the IP address-to-tag mapping on another User-ID agent using an HTTP server profile. If you select this option, you must configure an HTTP server profile (see Step 5).
    6. Enter or select the
      Tags
      you want to add to the policy object.
      You may need to click outside of the field or press Enter to enable the
      OK
      button.
    7. Click
      OK
      .
      ip-tag-timeout.png
  5. (
    Remote User-ID only
    ) Configure an HTTP server profile to forward logs to a remote User-ID agent.
    1. Select
      Device
      Server Profiles
      HTTP
      .
    2. Add
      a profile and specify a
      Name
      for the server profile.
    3. (
      Virtual systems only
      ) Select the
      Location
      . The profile can be
      Shared
      across all virtual systems or can belong to a specific virtual system.
    4. Select
      Tag Registration
      to enable the firewall to register the IP address and tag mapping with the User-ID agent on a remote firewall. With tag registration enabled, you cannot specify the payload format.
    5. Add
      the server connection details to access the remote User-ID agent and click
      OK
      .
      http_server_profile_tag.PNG
    6. Select the log forwarding profile you created then select this server profile as the HTTP server profile for your
      Remote User-ID
      tag
      Registration
      .
  6. Define the policy objects to which you want to apply the tags.
    1. Create or select one of the following policy objects: dynamic address groups, Use Dynamic User Groups in Policy, addresses, address groups, zones, policy rules, services, or service groups.
    2. Enter the tags you want to apply to the object as the
      Match
      criteria.
      Confirm that the tag is identical to the tag in Step 4.
  7. Add the tagged policy objects to your policy.
    This workflow uses a Security policy as an example, but you can also use tagged policy objects in Authentication policy.
    1. Select
      Policies
      Security
      .
    2. Click
      Add
      and enter a
      Name
      and optionally a
      Description
      for the policy.
    3. Add the
      Source Zone
      where the traffic originates.
    4. Add the
      Destination Zone
      where the traffic terminates.
    5. Select the
      Source
      object you created in Step 5.1.
    6. Select whether the rule will
      Allow
      or
      Deny
      the traffic.
  8. If you configured a log forwarding profile, assign it to your Security policy.
    You can assign one log forwarding profile for each policy but you can assign multiple methods and actions per profile. For an example, refer to Use Dynamic Address Groups in Policy.
  9. Commit
    your changes.
  10. (Optional) Configure a timeout to remove the tag from the policy object after the specified time has elapsed.
    Specify the amount of time (in minutes) that passes before the firewall removes the tag from the policy object. The range is from 0 to 43,200. If you set the timeout to zero, the IP address-to-tag mapping does not timeout and must be removed with an explicit action. If you set the timeout to the maximum of 43,200 minutes, the firewall removes the tag after 30 days.
    You cannot configure a Timeout with a
    Remove Tag
    action.
    1. Select the log forwarding profile.
    2. Add
      or edit one of the
      Built-in Actions
      .
    3. Specify the
      Timeout
      (in minutes). When the specified time has elapsed, the firewall or Panorama removes the tag.
      Set the IP-tag timeout to the same amount of time as the DHCP lease timeout for that IP address. This allows the IP address-to-tag mapping to expire at the same time as the DHCP lease so that you do not unintentionally apply policy when the IP address is reassigned.
    4. Click
      OK
      and
      Commit
      your changes.

Recommended For You