Skip to content
ConfigProof

Product

What ConfigProof actually does

It reads a supported firewall XML export, runs deterministic controls over the modules you selected, and turns the results into a report, a plan and a diagram. Everything it cannot prove from that export is stated rather than implied.

PA-5410-HQ

AnalyzedSample data
Vendor
Palo Alto Networks
Model
PA-5410

Scoped Assessment Score

72

of 100

Scored over the analyzed modules only.

Configuration Coverage

78%

14 of 18 modules analyzed

Findings by severity

  • High72
  • Medium143
  • Low98
  • Observation211
  • Total524

Modules analyzed

14 / 18

4 not analyzed

  • Decryption
  • GlobalProtect
  • QoS
  • Panorama Advanced

This is a partial scoped analysis 4 modules were not included, and they stay visible as Not analyzed in the dashboard and in the report.

Product demonstration, sample data from a fictional environment.

The workflow

Six stages, each one visible in the product.

  1. 01

    Secure upload

    A one-time signed upload into tenant-scoped ephemeral storage, with size, extension and time limits enforced on the server.

  2. 02

    Hardened parse

    External entity resolution, DTD loading and network access are disabled, and depth, element count and processing time are bounded.

  3. 03

    Normalization

    The supported configuration becomes immutable structured entities and a reference graph. The raw XML is deleted once this succeeds.

  4. 04

    Scope selection

    Detected modules are shown before anything runs. You select which receive full analysis and acknowledge that the rest are not analyzed.

  5. 05

    Deterministic controls

    Controls read the normalized model, not the text. Each finding records its control ID, evidence, affected entities and base severity.

  6. 06

    Review and delivery

    You review, override with a reason, include or exclude, then publish a report revision, a WBS plan and a diagram version.

Analysis modules

The Phase 1 catalog. Depth is declared per module, and a module that is not supported says so instead of quietly passing.

  • System and MetadataCore
  • Administrators and AccessCore
  • Certificates and PKICore
  • Interfaces and SegmentationCore
  • Routing and Network ServicesCore
  • High AvailabilitySelected checks
  • Security PoliciesCore
  • NATCore
  • DecryptionSelected checks
  • Security ProfilesCore
  • DoS and Zone ProtectionSelected checks
  • ObjectsCore
  • IPSec VPNCore
  • GlobalProtectSelected checks
  • Identity and AuthenticationSelected checks
  • Logging and IntegrationsCore
  • QoSInventory only
  • Panorama AdvancedStaged

Core means the full control set. Selected checks means a documented subset. Inventory only means the module is parsed and listed but not scored. Staged means it ships in stages and says which.

The evidence model

A finding is a claim, so it carries the grounds for that claim and the level of confidence behind it.

Fact
Read directly from the configuration. The path and the value are printed.
Derived
Computed from configuration facts, such as an object expansion or a resolved reference chain.
Contextual
Depends on an assumption about the environment that the export does not settle.
Hypothesis
A candidate for review. It is never presented as a proven defect.

Deterministic code decides what is a fact

Vendor detection, parsing, normalization, reference resolution, control predicates, base severity, evidence paths, affected entity IDs, module coverage and score inputs are all produced by code, and the same input produces the same result.

The model explains, and nothing more

It may draft an explanation, remediation wording, validation steps and WBS suggestions from facts it was given. Output is validated against a strict schema, and anything referencing an unknown ID, path or value is rejected.

What you hand over

Report

Two templates, a configurable cover, selectable sections, an automatic table of contents and immutable revisions with a client-facing change log.

WBS handoff

Phases and tasks linked to findings, with low and high effort ranges clearly labeled as suggestions that need engineering validation. Export as PDF, CSV or a copyable table.

Diagram

A configured-topology graph generated from the snapshot, with drag and drop editing, versions, PNG, SVG and PDF export, and insertion into the report.

What an XML export cannot prove

Stated here rather than buried, because the value of the report depends on it.

  • Whether a rule carries traffic. There are no hit counts, sessions or logs in a configuration export, so an unused-looking rule is a candidate for runtime validation, never a proven dead rule.
  • Runtime reachability. ConfigProof reports a Configured Permitted Flow and a Configured Route, not guaranteed reachability.
  • Tunnel, peer, ARP and routing-table state. None of it exists in the file.
  • Business intent. Whether a permissive rule is wrong is a judgement, so the finding gives you the evidence and you make the call.
  • Anything outside the modules you selected. Unselected modules stay visible as Not analyzed in both the dashboard and the report.

Not available today

These are on the roadmap. Nothing in the product pretends otherwise.

  • Live collection from a firewall API, or a local connector.Coming later
  • Scheduled collection, drift alerts and continuous monitoring.Coming later
  • A public customer API and webhooks.Coming later
  • Ticketing and service-management integrations.Coming later
  • SSO, SAML and SCIM.Coming later
  • Private, on-premises or air-gapped deployment.Coming later
  • Automatic remediation or any push to a device.Coming later
  • Production support for vendors beyond the Phase 1 adapter.Coming later

See it on a real configuration

The sample report is a complete deliverable on a sanitized export, including the sections that say what could not be proven.

Open the sample reportSee pricing