Resources
Understand the product before you buy it
The deliverable, the export guide, the method and the control library, all readable without an account.
Sample report
A complete deliverable on a sanitized configuration, including the scope and limitations section that states what could not be proven. This is the document a client receives.
Supported export guide
What to upload, and how to produce it.
Supported today
- Palo Alto Networks PAN-OS, an XML configuration export from a standalone firewall.
- Panorama, an XML export analyzed as a management model: device groups, shared, pre-rulebase and post-rulebase policy, templates, template stacks and variables.
- A bounded Panorama bundle containing the Panorama export plus one or more managed-firewall exports, matched with your confirmation before any asset is created.
How to produce the export
- 01In the firewall or Panorama web interface, open Device, then Setup, then Operations.
- 02Choose Export named configuration snapshot, or Export configuration version for a specific candidate.
- 03Select the running configuration unless you are deliberately reviewing a saved candidate.
- 04Save the .xml file. Do not rename it to disguise the vendor: ConfigProof detects vendor and version from the content, not the file name.
Before you upload
- A configuration export contains no logs, hit counts, sessions or routing table state, so nothing in the report will claim them.
- A Panorama-only export is a management-model analysis. It is not the effective configuration of every managed firewall.
- The raw file is deleted as soon as it is normalized. Keep your own copy if you need one.
Analysis methodology
How a finding gets made, and what decides its severity.
The pipeline
- 01Hardened parse of the export, with entity resolution and network access disabled.
- 02Vendor and version detection from content, never from the file name.
- 03Normalization into immutable entities plus a reference graph over every configuration relationship.
- 04Deterministic controls over the selected modules only.
- 05Evidence capture: control ID, configuration path, normalized values, affected entity IDs.
- 06Optional model enrichment of the wording, validated against a strict schema.
- 07Scoped Assessment Score and Configuration Coverage, always reported together.
Score and coverage, never one without the other
A score computed over four modules is not the same claim as a score computed over eighteen. ConfigProof shows the Scoped Assessment Score beside Configuration Coverage everywhere it appears, in the dashboard and in the report, and a partial assessment carries a mandatory scope and limitations section.
Configuration Coverage The share of detected modules that received full control analysis. Modules you did not select stay visible as Not analyzed rather than disappearing.
Severity and confidence are separate axes
A finding can be severe and uncertain at the same time. Base severity comes from the control definition, confidence comes from the evidence available, and the two are never blended into one number that hides both. When you override a severity, the original machine value stays on the record with your reason beside it.
Language rules
The words are chosen so a reader cannot infer a claim the analysis did not make.
- Configured Permitted Flow
- What the configuration permits. Not a statement that traffic flows.
- Configured Route
- A route present in the configuration. Not a learned or installed route.
- No configuration references found
- Said of an object. It is not the same as saying the object is unused in production.
- Candidate for runtime validation
- Said of a rule that looks unused. Without hit counts, no export can prove it.
- Review candidate
- Said of a merge or consolidation. Safe to merge is only used when every behavior-affecting field is proven equivalent.
Control library
Every control has a stable ID, a documented predicate, a positive and a negative fixture, and a supported-version note. Counts read from the shipped rule pack.
Showing 33 of 33
- PAN-SEC-001CriticalCIS PAN-OS Benchmark 8.1
Allow rule matches any source and any destination
An enabled allow rule whose source and destination both resolve to any permits every address pair the zones can reach. This is the single most common cause of unintended lateral movement and inbound exposure.
- Category
- Policy hygiene
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-002HighCIS PAN-OS Benchmark 8.2
Allow rule matches any application
App-ID is the reason to buy this platform. An allow rule with application any degrades the firewall to port based filtering and lets any protocol ride an allowed port.
- Category
- Policy hygiene
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-003HighCIS PAN-OS Benchmark 8.3
Allow rule matches any service
Service any opens every TCP and UDP port for the matched applications. With application any as well, the rule is a permit ip any any.
- Category
- Policy hygiene
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-004Low
Disabled rule left in the rulebase
Disabled rules accumulate, hide intent and get re-enabled by accident during an incident. They also make the rulebase harder to review.
- Category
- Policy hygiene
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-005LowCIS PAN-OS Benchmark 8.5
Rule has no description and no tag
A rule with no description and no tag has no recorded owner or business reason, so nobody can safely remove it later. This is how rulebases rot.
- Category
- Policy hygiene
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-006Medium
Temporary rule with no schedule or expiry
A rule whose name or description marks it as temporary but which has no schedule attached will stay in place forever. Temporary access that never expires is permanent access nobody reviewed.
- Category
- Policy hygiene
- Default confidence
- 0.85
- Evidence required
- Yes
- PAN-SEC-007HighCIS PAN-OS Benchmark 8.4
Allow rule with logging fully disabled
An allow rule with neither log at session start nor log at session end produces no record of the traffic it permits. Incident response on that path is blind.
- Category
- Policy hygiene
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-008MediumCIS PAN-OS Benchmark 8.4
Rule does not log at session end
Log at session end records bytes, duration and the final application. Rules that only log at session start lose all of that.
- Category
- Policy hygiene
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-009Medium
Rule has no log forwarding profile
Without a log forwarding profile the logs stay on the appliance and are lost when the local log partition wraps. External retention is what makes an investigation possible weeks later.
- Category
- Policy hygiene
- Default confidence
- 0.90
- Evidence required
- Yes
- PAN-SEC-010HighCIS PAN-OS Benchmark 6.1
Allow rule without any security profile
An allow rule with no profile group and no inline profiles passes traffic without antivirus, anti-spyware, vulnerability protection, URL filtering or WildFire inspection. The firewall is acting as a router for that flow.
- Category
- Security profiles
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-011CriticalCIS PAN-OS Benchmark 6.2
Inbound internet rule without threat prevention
A rule that allows traffic arriving from an untrusted zone but attaches no antivirus, anti-spyware or vulnerability protection profile leaves the exposed service with no inspection in front of it.
- Category
- Security profiles
- Default confidence
- 0.90
- Evidence required
- Yes
- PAN-SEC-012HighCIS PAN-OS Benchmark 6.3
Outbound internet rule without URL filtering
Outbound web traffic without a URL filtering profile has no category blocking and no credential phishing protection, and it produces no URL log for later investigation.
- Category
- Security profiles
- Default confidence
- 0.85
- Evidence required
- Yes
- PAN-SEC-013MediumCIS PAN-OS Benchmark 6.4
Allow rule without WildFire analysis
Without a WildFire analysis profile, unknown files crossing this rule are never submitted for detonation, so novel malware is only caught if a signature already exists.
- Category
- Security profiles
- Default confidence
- 0.90
- Evidence required
- Yes
- PAN-SEC-014MediumCIS PAN-OS Benchmark 7.1
No decryption policy covering outbound traffic
Threat prevention cannot inspect what it cannot read. With no decryption rule covering outbound sessions, most of the security profiles attached to outbound rules only see the TLS handshake.
- Category
- Security profiles
- Default confidence
- 0.60
- Evidence required
- Yes
- PAN-SEC-015Low
Duplicate address objects with the same value
Two or more address objects hold the same value under different names. A change applied to one of them silently leaves the others behind, so policy drifts apart over time.
- Category
- Objects
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-016Observation
Object is defined but never referenced
Unreferenced address and service objects enlarge the configuration, slow commits and make review harder. They are also a common sign of an incomplete decommission.
- Category
- Objects
- Default confidence
- 0.80
- Evidence required
- Yes
- PAN-SEC-017High
Address group is dangerously broad
An address group that contains 0.0.0.0/0, or that has grown past a reviewable number of members, means every rule using it is far wider than its name suggests.
- Category
- Objects
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-018Critical
Allow rule uses an object that resolves to the whole internet
The rule looks specific because it names an object, but that object resolves to 0.0.0.0/0. The name hides the breadth from every reviewer.
- Category
- Objects
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-019Medium
Rule is shadowed and can never match
An earlier rule in the same policy chain matches every packet this rule would match, and takes a different action. This rule is dead configuration, and if it was meant to permit something, that traffic is being denied.
- Category
- Rule logic
- Default confidence
- 0.95
- Evidence required
- Yes
- PAN-SEC-020Low
Rule is redundant
An earlier rule already matches everything this rule matches and takes the same action, so this rule changes nothing. It is pure review burden.
- Category
- Rule logic
- Default confidence
- 0.95
- Evidence required
- Yes
- PAN-SEC-021High
Broad allow rule generalizes earlier specific rules
A later allow rule is broad enough to cover several earlier specific rules. Whatever those specific rules were guarding, the broad rule permits anyway, so the specificity above it is decorative.
- Category
- Rule logic
- Default confidence
- 0.90
- Evidence required
- Yes
- PAN-SEC-022High
Permissive allow rule is evaluated before restrictive rules
A wide open allow rule sits above deny rules in the same chain. Those deny rules only ever see traffic the wide rule did not already permit, which is usually the opposite of the intent.
- Category
- Rule logic
- Default confidence
- 0.90
- Evidence required
- Yes
- PAN-SEC-023Critical
Inbound destination NAT without a restrictive security rule
A destination NAT rule publishes an internal host to an untrusted zone, but no security rule restricts who may reach it. NAT alone permits nothing on PAN-OS, so either the host is unreachable or a broad rule is permitting it.
- Category
- NAT and exposure
- Default confidence
- 0.80
- Evidence required
- Yes
- PAN-SEC-024High
Destination NAT published with a broad service
The destination NAT rule matches service any, so every port on the internal host is reachable through the translation, not only the service that was meant to be published.
- Category
- NAT and exposure
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-025High
Bidirectional static source NAT creates an implicit inbound path
A static source NAT with bi-directional enabled also creates the reverse destination NAT. The internal host becomes addressable from outside without an explicit inbound NAT rule that a reviewer would notice.
- Category
- NAT and exposure
- Default confidence
- 0.90
- Evidence required
- Yes
- PAN-SEC-026CriticalCIS PAN-OS Benchmark 1.2
Management access allows HTTP or Telnet
HTTP and Telnet carry management credentials in clear text. Anyone on the path between an administrator and the firewall can read the session.
- Category
- Platform hardening
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-027HighCIS PAN-OS Benchmark 1.3
Interface management profile has no permitted IP restriction
An interface management profile that enables management services without a permitted IP list exposes the management plane to every host that can reach the interface address.
- Category
- Platform hardening
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-028MediumCIS PAN-OS Benchmark 2.1
More superuser administrators than a small team needs
Every superuser account is a full compromise of the device if it is taken over. Most day to day work fits a read-only or a device administrator role.
- Category
- Platform hardening
- Default confidence
- 0.75
- Evidence required
- Yes
- PAN-SEC-029HighCIS PAN-OS Benchmark 2.2
Well known administrator account is active with full privilege
An account with a predictable name such as admin or apiuser holds the superuser role. Predictable names are the first thing credential stuffing tries.
- Category
- Platform hardening
- Default confidence
- 0.90
- Evidence required
- Yes
- PAN-SEC-030HighCIS PAN-OS Benchmark 3.1
No syslog forwarding configured
Without syslog forwarding, logs live only on the appliance and are lost when the log partition wraps or the device is rebuilt. That removes the evidence an investigation depends on.
- Category
- Platform hardening
- Default confidence
- 0.85
- Evidence required
- Yes
- PAN-SEC-031MediumCIS PAN-OS Benchmark 1.5
No NTP server configured
Without NTP the device clock drifts, so log timestamps stop correlating with every other system and certificate validation can fail.
- Category
- Platform hardening
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-032MediumCIS PAN-OS Benchmark 1.4
SNMP v2c is enabled
SNMP v2c authenticates with a community string sent in clear text and has no encryption. Anyone who can read the traffic can poll the device.
- Category
- Platform hardening
- Default confidence
- 1.00
- Evidence required
- Yes
- PAN-SEC-033LowCIS PAN-OS Benchmark 1.6
No login banner configured
A login banner is a small control, but many audit regimes require an authorized-use notice before administrative access.
- Category
- Platform hardening
- Default confidence
- 1.00
- Evidence required
- Yes
Where a control aligns with a published benchmark, the benchmark is cited as a reference. It is not a certification.
Data handling guide
The raw XML lifecycle, retention by plan, what is redacted before anything is logged, what support can see and how to report a vulnerability, all on one page.
Changelog
Product and analyzer changes that affect a result you already published.
Phase 1 specification adopted
Assessment Cycles, module scope selection with acknowledgement, the Scoped Assessment Score beside Configuration Coverage, the report builder with immutable revisions, the WBS Planner and the Diagram Canvas.
Evidence levels on every finding
Findings now carry fact, derived, contextual or hypothesis alongside confidence, and human overrides are stored beside the original machine result rather than replacing it.
Raw configuration deletion receipt
The deletion timestamp for the uploaded file is recorded and shown on the assessment.
An analyzer version change never rewrites a published report revision. The revision records the parser and analyzer version that produced it.
Still deciding?
Read the security page for the data handling detail, or start with the free preview and judge the output yourself.