Admin Lockout Time is not within the recommended range-paloaltonetworks-panos

Admin Lockout Time is not within the recommended range-paloaltonetworks-panos
0

Admin Lockout Time is not within the recommended range-paloaltonetworks-panos

Vendor: paloaltonetworks

OS: panos

Description:
Indeni will alert if the Admin Lockout Time is not within the recommended range.

Remediation Steps:
Ensure Lockout Time is set to a value greater than or equal to 30

How does this work?
This alert uses the Palo Alto Networks API interface to parse through the configured management setting and verify lock out time is set to a value greater than or equal to 30 minutes.

Why is this important?
Lockout time helps in disconnecting an administrator for certain time period before the next login attempt is made to make sure continuous attempts are not made to login into the system. This generally is observed with malicious intent and it controls this behavior. Use the command “request authentication unlock-admin user” to unlock the admin user.

Without Indeni how would you find this?
Login to the device’s web interface and click on “Device” -> “Management” -> “Authentication Settings” and check the configured threshold value.

panos-admin-lockout-time

name: panos-admin-lockout-time
description: Ensure lockout time is set to a value greater than or equal to 30
type: monitoring
monitoring_interval: 60 minutes
requires:
    vendor: paloaltonetworks
    os.name: panos
    product: firewall
comments:
    admin-lockout-time:
        why: "Lockout time helps in disconnecting an administrator for certain time\
            \ period before the next login attempt is made to make sure continuous\
            \ attempts are not made to login into the system. \nThis generally is\
            \ observed with malicious intent and it controls this behavior. \nUse\
            \ the command \"request authentication unlock-admin user\" to unlock the\
            \ admin user.\n"
        how: |
            This alert uses the Palo Alto Networks API interface to parse through the configured management setting and verify lock out time is set to a value greater than or equal to 30 minutes.
        can-with-snmp: false
        can-with-syslog: false
steps:
-   run:
        type: HTTP
        command: /api/?type=config&action=get&xpath=/config/devices/entry/deviceconfig/setting/management/admin-lockout&key=${api-key}
    parse:
        type: XML
        file: panos-admin-lockout-time.parser.1.xml.yaml

PanosAdminLockoutTimeRule

Failed to fetch the data: https://bitbucket.org/indeni/indeni-knowledge/src/master/rules/templatebased/paloaltonetworks/PanosAdminLockoutTimeRule.scala