Convert Rules Using the Panorama Web Interface
Table of Contents
Convert Rules Using the Panorama Web Interface
Use the Panorama™ web interface to convert IPS rules
to custom PAN-OS
®
threat signatures.After you install the intrusion prevention
system (IPS) signature converter plugin, you can use it to translate
Snort and Suricata rules into custom Palo Alto Networks threat
signatures. You can then register the custom signatures on
Palo Alto Networks firewalls that belong to device groups that you
specify and use these customer signatures in your Vulnerability
Protection and Anti-Spyware Security Profiles.
Additionally,
you can export rules that list IP address indicators of compromise (IOC)
and use the resultant text file as an external dynamic list to enforce
policy on the entries contained in the list.
The following
example uses this Snort rule:
alert tcp any any -> any any (msg:"Malformed_UA"; content:"User-Agent: Mozillar/"; depth:500; sid:99999999;)
- Select .
- Upload Signatures.
- Select one of two methods for uploading your rules:
- Browseto and select a text file.You cannot convert binary file types, such as .pdf or .docx.
- Paste the rules directly into the text box.
You can upload only 300 rules at a time for conversion.
- ClickOK.Your signatures will populate at least one of the following tabs:Succeeded,Succeeded with Warnings,Failed,Duplicates, orExisting Coverage.
- (Optional) Export rules to an indicator of compromise (IOC) list.Panorama converts a rule that does not contain the keywordscontentorPCREinto anIOC List.Export IOC Listto group these rules into a text file that you can use as an external dynamic list for your Security policy rules.
- SelectExport IOC List.A dialog displays any rules that converted asIOC List.
- Select the rules that you want to export.
- Enter the name of the file to which you want to export your rules.
- ClickOK.The exported text file will appear in your downloads folder.
- Commit converted signatures to Panorama.
- Select the signatures you want to upload.
- Import Custom Signatures.
- Select a Device Group from the drop-down.SelectSharedto make the signatures available to all device groups.
- Under the Destination column, select whether to commit the signatures asVulnerabilityorSpyware.
- ClickOK.
- In the top right of the screen, select
and Commit to Panorama. - Verify that you successfully committed your signatures.
- Select .
- Select eitherSpywareorVulnerability, depending on how you categorized your signatures in the previous step.
- The firewalls must be running PAN-OS 10.0 or a later release with an active Threat Prevention license.
- Test your signatures on a firewall in the device group to which you pushed the signatures.