>
    Strata Copilot
    Example: Manage and Secure Network Security with Strata Cloud Manager
    Focus
    Download PDF
    Focus
    1. Home
    2. Strata Cloud Manager
    3. Strata Cloud Manager Activation & Onboarding
    4. Operationalize Strata Cloud Manager
    5. Example: Manage and Secure Network Security with Strata Cloud Manager
    Download PDF
    Strata Cloud Manager

    Example: Manage and Secure Network Security with Strata Cloud Manager

    Table of Contents

    Example: Manage and Secure Network Security with Strata Cloud Manager

    Learn how to operationalize network security with Strata Cloud Manager.
    Where Can I Use This?What Do I Need?
    One of these:
    This example demonstrates how to manage and secure a large financial institution's global network infrastructure using Strata Cloud Manager.

    Day 0: Resolve Critical Health Alerts

    To address critical health alerts, navigate to Incidents > NGFW in Strata Cloud Manager and filter by the Health category. Address the following alerts:
    • Adverse Encrypted Traffic Resource Usage
      Indicates low resources for encrypted traffic.
      Action: Analyze traffic patterns and reallocate resources to support encrypted traffic.
    • Approaching Max Configuration Limits
      Firewall objects (rules, groups, and security profiles) are nearing device limits.
      Action: Review and optimize configurations to stay within limits.
    • Increased Traffic Latency - Packet Buffer
      Packet Buffer resources are running low.
      Action: Analyze network traffic and adjust resource allocation to ensure sufficient buffer capacity.
    • Tunnel Down
      Site-to-Site VPN Tunnels are down.
      Action: Investigate the VPN configuration and connectivity issues, and restore the affected tunnels.
    • NAT Allocation Failure
      A NAT rule cannot allocate sufficient resources for translation.
      Action: Review and adjust NAT rules to ensure adequate resource allocation.

    Day 1: Improve Security Posture and Device Health

    • Best Practices Compliance
      Navigate to the Best Practices dashboard to evaluate security feature configurations against Palo Alto Networks' best practices.
      Action: Filter by device group and assess specific policy rules for compliance. Adjust configurations as needed.
    • Device Posture Insights
      Use the Security Posture Insights dashboard to review device health, including operational status and software versions.
      Action: Plan upgrades for outdated software versions using Insights > NGFW > Upgrade Recommendations.
    • Threat Detection and Response
      Ensure threat intelligence feeds are updated regularly to detect threats effectively.
      Action: Set up alert notifications for critical alerts so that you can respond to them immediately. Furthermore, integrate AIOps with your incident response platform to automate the response process.

    Day 2: Address Remaining Health Alerts

    Resolve vulnerabilities flagged in health alerts, such as:
    • Stale Threat Content
      Threat intelligence feeds are outdated.
      Action: Update feeds by verifying connectivity with the threat intelligence servers and scheduling regular updates.
    • Expired Certificates
      SSL/TLS certificates used for secure communication have expired.
      Action: Renew certificates through the issuing Certificate Authority (CA) and configure them on relevant devices.
    • Expired Licenses
      Licenses for Palo Alto Networks products have expired.
      Action: Renew licenses through your Palo Alto Networks sales representative or customer portal.
    • HA Issues
      High Availability (HA) between firewalls is not functioning correctly.
      Action: Verify HA configurations, including links, statuses, and synchronization, and resolve any issues per documentation.

    Day 3: Review Critical Security Alerts and Assess CVEs

    Review Critical Security Alerts
    Let’s consider some examples to review security alerts.
    • Anti-Spyware Profile Not Strict
      This alert indicates that one of your Anti-spyware profiles isn't strict, which could potentially allow spyware activity on the network. After receiving this alert, your security team reviews the alert details. They find that the alert is related to the security posture of their platform and falls under the category of Malware Defenses. The alert suggests that to prevent spyware activity on the network, they should clone the predefined strict Anti-Spyware profile and retain the default “reset-both” Action for critical, high, and medium severity levels.
      Action: Clone and configure a strict profile to block spyware effectively.
    • Application Not Set in Rule
      This alert indicates that an application isn't set in a rule, which could potentially allow unauthorized traffic through the firewall. However, upon reviewing the alert, the security team realizes that this is due to a new application that they are currently testing. They have intentionally not set the application in a rule yet because they are still in the process of evaluating the application's security.
      Action: Temporarily suppress the alert if the application is under evaluation. Revisit and configure the rule after completing testing.
    Assess CVE Health
    Navigate to PAN-OS CVEs to see the security advisories impacting your firewall. This information helps you decide whether to upgrade a firewall based on the vulnerability and its impact on the NGFW’s Health and Security.
    For example, select a PAN-OS Known Vulnerability (CVE-2021-44228) incident to see the security advisory on this CVE impacting your firewall, and then navigate to Vulnerabilities Affecting this Device Based on Enabled Features to view the affected features for a vulnerability in the Feature Affected column. If a CVE is not associated with a feature, then the value under Feature Affected is empty.
    You also select Vulnerabilities in this PAN-OS version. This helps you decide whether to upgrade a firewall based on the vulnerability and its impact beyond your enabled features. This type of CVE affects the firewall with the specified model or version.
    After understanding the vulnerabilities for impacted devices, you can plan your patching using the Software Upgrade Recommendations feature. View the Impacted Devices and select firewalls that you want to upgrade to fix the vulnerabilities, and Generate Upgrade Recommendations. You are redirected to Software Upgrade Recommendations to view the generated report.
    You can also navigate to Insights > NGFW > Upgrades Recommendations and Generate a New Upgrade Recommendation. Use this recommendation to upgrade all your NGFWs to the recommended PAN-OS version.

    Day 4: Analyze Activity Insights and Address Security Policy Gaps

    • Review Activity Insights: Navigate to the Activity Insights dashboard in your Strata Cloud Manager. You can view a holistic picture of all threats detected and blocked in your network across various security subscriptions. As an example, you notice an alert about "Anti-Spyware Profile Not Strict". After reviewing the alert details, you clone the predefined strict Anti-Spyware profile and adjust the settings as suggested.
    • Addressing Security Gaps: While reviewing the Activity Insights dashboard, identify the security policy rules that enforced the blocked and allowed threats. You notice that some rules are allowing threats. To address this, you review these rules and make necessary modifications to ensure they block such threats in the future.
    • Suppression: In another instance, you notice an alert about "Application Not Set In Rule". However, upon reviewing the alert, you realize that this is due to a new application that you are currently testing. You have intentionally not set the application in a rule yet because you are still in the process of evaluating the application's security. In this case, you decide to suppress the alert temporarily until you have complete your testing and evaluation of the new application.
    • Assessing Most Impacted Applications and Users: The Activity Insights dashboard also provides information about the applications and users most impacted by the threats. You review this information to identify any patterns or trends that might indicate a larger security issue. If necessary, you take action to address these issues, such as updating security policies or providing additional training to users.

    Ongoing Risk Management

    • Regularly review the Activity Insights dashboard to monitor threats and refine operational workflows.
    • Check the Best Practices dashboard periodically, as recommendations evolve with product improvements and industry trends.
    By following this workflow, you can streamline ongoing risk management and maintain a secure and efficient network infrastructure.

    © 2026 Palo Alto Networks, Inc. All rights reserved.