Certificate(s) expiration nearing-paloaltonetworks-panos

error
panos
paloaltonetworks
Certificate(s) expiration nearing-paloaltonetworks-panos
0

#1

Certificate(s) expiration nearing-paloaltonetworks-panos

Vendor: paloaltonetworks

OS: panos

Description:
Indeni will alert when a certificate is about to expire. " +
"The threshold for the number of days before certificate expiration can be adjusted by the user.

Remediation Steps:
Renew any certificates that need to be renewed.
||Please review this article on Palo Alto Networks Support Site:
|Revoke and Renew Certificates.

How does this work?
This script pulls the Palo Alto Networks firewall’s active configuration, reviews the certificates saved and retrieves their subject and expiration date.

Why is this important?
Palo Alto Networks firewalls use certificate for a variety of different purposes. One purpose, for example, is inbound SSL inspection. If the certificate used by the firewall expires, certain services may be unavailable to external users.

Without Indeni how would you find this?
An administrator may manually review the certificates and their expiration dates, by looking at the web interface.

panos-show_config_running-monitoring-xml

#! META
name: panos-show_config_running-monitoring-xml
description: Fetch the running config (xml)
type: monitoring
monitoring_interval: 60 minute
requires:
    vendor: paloaltonetworks
    os.name: panos

#! COMMENTS
certificate-expiration:
    why: |
        Palo Alto Networks firewalls use certificate for a variety of different purposes. One purpose, for example, is inbound SSL inspection. If the certificate used by the firewall expires, certain services may be unavailable to external users.
    how: |
        This script pulls the Palo Alto Networks firewall's active configuration, reviews the certificates saved and retrieves their subject and expiration date.
    without-indeni: |
        An administrator may manually review the certificates and their expiration dates, by looking at the web interface.
    can-with-snmp: true
    can-with-syslog: true
timezone:
    why: |
        Most configurations in Palo Alto Networks firewalls are synchronized across cluster members. Some are not, the timezone is one of them. It is important to verify that the timezone is the same on all cluster members to avoid confusion or issues.
    how: |
        This script pulls the Palo Alto Networks firewall's active configuration and extracts the timezone from there.
    without-indeni: |
        An administrator may write a script to pull this data from cluster members and compare it.
    can-with-snmp: false
    can-with-syslog: false
domain:
    why: |
        Most configurations in Palo Alto Networks firewalls are synchronized across cluster members. Some are not, the domain name is one of them. It is important to verify that the domain name is the same on all cluster members to avoid confusion or issues.
    how: |
        This script pulls the Palo Alto Networks firewall's active configuration and extracts the timezone from there.
    without-indeni: |
        An administrator may write a script to pull this data from cluster members and compare it.
    can-with-snmp: false
    can-with-syslog: false
login-banner:
    why: |
        Most configurations in Palo Alto Networks firewalls are synchronized across cluster members. Some are not, the login banner is one of them. It is important to verify that the login banner is the same on all cluster members to avoid confusion or issues.
    how: |
        This script pulls the Palo Alto Networks firewall's active configuration and extracts the timezone from there.
    without-indeni: |
        An administrator may write a script to pull this data from cluster members and compare it.
    can-with-snmp: false
    can-with-syslog: false
syslog-servers:
    why: |
        Tracking the currently configured Syslog servers on all devices is important to ensure consistent logging.
    how: |
        This script pulls the Palo Alto Networks firewall's active configuration and extracts the configured Syslog servers from there.
    without-indeni: |
        An administrator may write a script to pull this data from devices and compare against a gold configuration.
    can-with-snmp: false
    can-with-syslog: false
radius-servers:
    why: |
        Tracking the currently configured RADIUS servers on all devices is important to ensure consistent authentication and access.
    how: |
        This script pulls the Palo Alto Networks firewall's active configuration and extracts the configured RADIUS servers from there.
    without-indeni: |
        An administrator may write a script to pull this data from devices and compare against a gold configuration.
    can-with-snmp: false
    can-with-syslog: false
dns-servers:
    why: |
        Tracking the currently configured DNS servers on all devices is important to ensure consistent name resolution.
    how: |
        This script pulls the Palo Alto Networks firewall's active configuration and extracts the configured DNS servers from there.
    without-indeni: |
        An administrator may write a script to pull this data from devices and compare against a gold configuration.
    can-with-snmp: false
    can-with-syslog: false
ntp-servers:
    why: |
        Tracking the currently configured NTP servers on all devices is important to ensure consistent time sync.
    how: |
        This script pulls the Palo Alto Networks firewall's active configuration and extracts the configured NTP servers from there.
    without-indeni: |
        An administrator may write a script to pull this data from devices and compare against a gold configuration.
    can-with-snmp: false
    can-with-syslog: false
unencrypted-snmp-configured:
    why: |
        SNMPv2c is an unsecure protocol and should not be used. Users should prefer the more secure SNMPv3.
    how: |
        This script pulls the Palo Alto Networks firewall's active configuration and extracts the configured services from there.
    without-indeni: |
        An administrator may write a script to pull this data from devices and compare against a gold configuration.
    can-with-snmp: false
    can-with-syslog: false
telnet-enabled:
    why: |
        Telnet is an unsecure protocol and should not be used. Users may enable telnet unintentionally and should be alerted if they do so.
    how: |
        This script pulls the Palo Alto Networks firewall's active configuration and extracts the configured services from there.
    without-indeni: |
        An administrator may write a script to pull this data from devices and compare against a gold configuration.
    can-with-snmp: false
    can-with-syslog: false
http-server-enabled:
    why: |
        HTTP is an unsecure protocol and should not be used. Users may enable HTTP unintentionally and should be alerted if they do so.
    how: |
        This script pulls the Palo Alto Networks firewall's active configuration and extracts the configured services from there.
    without-indeni: |
        An administrator may write a script to pull this data from devices and compare against a gold configuration.
    can-with-snmp: false
    can-with-syslog: false
license-elements-used:
    skip-documentation: true
app-update-acceptable-lag:
    skip-documentation: true

#! REMOTE::HTTP
url: /api?type=op&cmd=<show><config><running></running></config></show>&key=${api-key}
protocol: HTTPS

#! PARSER::XML
_vars:
    root: /response/result/config
_metrics:
    -
        _groups:
            ${root}/shared/certificate/entry:
                _value.double:
                    _text: "expiry-epoch"
                _tags:
                    name:
                        _text: "subject"
                    "im.name":
                        _constant: "certificate-expiration"
                    "live-config":
                        _constant: "true"
                    "display-name":
                        _constant: "Certificate Expiration"
                    "im.dstype.displayType":
                        _constant: "date"
                    "im.identity-tags":
                        _constant: "name"
    -
        _value.complex:
            value:
                _text: "${root}/devices/entry/deviceconfig/system/timezone"
        _tags:
            "im.name":
                _constant: "timezone"
            "live-config":
                _constant: "true"
            "display-name":
                _constant: "Timezone"
    -
        _value.complex:
            value:
                _text: "${root}/devices/entry/deviceconfig/system/domain"
        _tags:
            "im.name":
                _constant: "domain"
            "live-config":
                _constant: "true"
            "display-name":
                _constant: "Domain"
    -
        _value.complex:
            value:
                _text: "${root}/devices/entry/deviceconfig/system/login-banner"
        _tags:
            "im.name":
                _constant: "login-banner"
            "live-config":
                _constant: "true"
            "display-name":
                _constant: "Login Banner"
    -
        _tags:
            "im.name":
                _constant: "app-update-acceptable-lag"
            "live-config":
                _constant: "true"
            "display-name":
                _constant: "Application Packages - Acceptable Lag"
            "im.dstype.displayType":
                _constant: "duration"
        _temp:
            isweekly:
                _count: "${root}/devices/entry/deviceconfig/system/update-schedule/threats/recurring/weekly"
            ishourly:
                _count: "${root}/devices/entry/deviceconfig/system/update-schedule/threats/recurring/hourly"
            isdaily:
                _count: "${root}/devices/entry/deviceconfig/system/update-schedule/threats/recurring/daily"
            threshold:
                # This is a hack. The threshold may, or may not exist.
                # If we were to refer to it directly and it didn't exist, the entire metric
                # would have been aborted. So instead, we "name" the text of it, as well as
                # another, related node. If the threshold exists, we'll be getting its value.
                # If it doesn't, we'll get "recurring" (the name of the node in the second path)
                _name: "${root}/devices/entry/deviceconfig/system/update-schedule/threats/recurring/threshold/text() | ${root}/devices/entry/deviceconfig/system/update-schedule/threats/recurring[not(threshold)]"
        _transform:
            _value.double: |
                    {
                        # The acceptable lag depends on the kind of schedule used
                        acceptablelag=0
                        if (temp("isweekly") == "1") {
                            acceptablelag=8*24*3600
                        } else if (temp("ishourly") == "1") {
                            acceptablelag=2*3600
                        } else if (temp("isdaily") == "1") {
                            acceptablelag=47*3600
                        }

                        # Add threshold
                        if (temp("threshold") != "recurring") {
                            acceptablelag = acceptablelag + (temp("threshold") * 3600)
                        }

                        print acceptablelag
                    }
    -
        _tags:
            "im.name":
                _constant: "panw-app-update-action"
            "live-config":
                _constant: "true"
            "display-name":
                _constant: "Application Packages - Update Action"
            "im.dstype.displayType":
                _constant: "string"
        _value.complex:
            value:
                _text: "${root}/devices/entry/deviceconfig/system/update-schedule/threats/recurring/*/action"
    -
        _groups:
            "${root}//syslog/entry/server/entry":
                _value.complex:
                    "host":
                        _text: "server"
                    "severity":
                        _text: "facility"
                _tags:
                    "im.name":
                        _constant: "syslog-servers"
                    "live-config":
                        _constant: "true"
                    "display-name":
                        _constant: "Syslog Servers"
        _value: complex-array
    -
        _groups:
            "${root}//radius/entry/server/entry":
                _value.complex:
                    "host":
                        _text: "ip-address"
                    "port":
                        _text: "port"
                _tags:
                    "im.name":
                        _constant: "radius-servers"
                    "live-config":
                        _constant: "true"
                    "display-name":
                        _constant: "RADIUS Servers"
        _value: complex-array
    -
        _groups:
            "/response/result/config/devices/entry/deviceconfig/system/dns-setting/servers/*":
                _value.complex:
                    "ipaddress":
                        _text: .
                _tags:
                    "im.name":
                        _constant: "dns-servers"
                    "live-config":
                        _constant: "true"
                    "display-name":
                        _constant: "DNS Servers"
        _value: complex-array
    -
        _groups:
            "/response/result/config/devices/entry/deviceconfig/system/ntp-servers/*/ntp-server-address":
                _value.complex:
                    "ipaddress":
                        _text: .
                _tags:
                    "im.name":
                        _constant: "ntp-servers"
                    "live-config":
                        _constant: "true"
                    "display-name":
                        _constant: "NTP Servers"
        _value: complex-array
    -
        _value.double:
            _count: /response/result/config/devices/entry/vsys/entry
        _tags:
            "name":
                _constant: "vsys"
            "im.name":
                _constant: "license-elements-used"
            "live-config":
                _constant: "true"
            "display-name":
                _constant: "Licenses - Usage"
            "im.dstype.displayType":
                _constant: "number"
            "im.identity-tags":
                _constant: "name"
    -
        _tags:
            "im.name":
                _constant: "unencrypted-snmp-configured"
        _temp:
            hasSnmpV2c:
                _count: "/response/result/config/devices/entry/deviceconfig/system/snmp-setting/access-setting/version/v2c"
        _transform:
            _value.complex:
                value: |
                    {
                        if (temp("hasSnmpV2c") == "1") {
                            print "true"
                        } else {
                            print "false"
                        }
                    }
    -
        _tags:
            "im.name":
                _constant: "telnet-enabled"
        _temp:
            hasTelnetAtNo:
                _count: "${root}/devices/entry/deviceconfig/system/service/disable-telnet[text() = 'no']"
        _transform:
            _value.complex:
                value: |
                    {
                        if (temp("hasTelnetAtNo") == "1") {
                            print "true"
                        } else {
                            print "false"
                        }
                    }
    -
        _tags:
            "im.name":
                _constant: "http-server-enabled"
        _temp:
            hasHttpAtNo:
                _count: "${root}/devices/entry/deviceconfig/system/service/disable-http[text() = 'no']"
        _transform:
            _value.complex:
                value: |
                    {
                        if (temp("hasHttpAtNo") == "1") {
                            print "true"
                        } else {
                            print "false"
                        }
                    }

RuleMetadata

.builder(
  "cross_vendor_certificate_will_expire
package com.indeni.server.rules.library.crossvendor

import com.indeni.ruleengine.expressions.conditions.{And, GreaterThan, LesserThan}
import com.indeni.ruleengine.expressions.core.{StatusTreeExpression, _}
import com.indeni.ruleengine.expressions.data.{SelectTagsExpression, _}
import com.indeni.ruleengine.expressions.math.PlusExpression
import com.indeni.ruleengine.expressions.utility.NowExpression
import com.indeni.server.params.ParameterDefinition
import com.indeni.server.params.ParameterDefinition.UIType
import com.indeni.server.rules._
import com.indeni.server.rules.library.{ConditionalRemediationSteps, RuleHelper}
import com.indeni.server.rules.library.core.PerDeviceRule
import com.indeni.server.sensor.models.managementprocess.alerts.dto.AlertSeverity
import com.indeni.server.common.data.conditions.True
import com.indeni.apidata.time.TimeSpan
import com.indeni.apidata.time.TimeSpan.TimePeriod

case class CrossVendorCertificateWillExpireRule() extends PerDeviceRule with RuleHelper {

  private val highThresholdParameterName = "Ahead_Alerting_Threshold"
  private val highThresholdParameter = new ParameterDefinition(highThresholdParameterName,
                                                               "",
                                                               "Expiration Threshold",
                                                               "How long before expiration should Indeni alert.",
                                                               UIType.TIMESPAN,
                                                               TimeSpan.fromDays(56))

  override val metadata: RuleMetadata = RuleMetadata
    .builder(
      "cross_vendor_certificate_will_expire",
      "All Devices: Certificate(s) expiration nearing",
      "Indeni will alert when a certificate is about to expire. " +
        "The threshold for the number of days before certificate expiration can be adjusted by the user.",
      AlertSeverity.ERROR
    )
    .configParameter(highThresholdParameter)
    .build()

  override def expressionTree(context: RuleContext): StatusTreeExpression = {
    val actualValue = TimeSeriesExpression[Double]("certificate-expiration").last.toTimeSpan(TimePeriod.SECOND)

    StatusTreeExpression(
      // Which objects to pull (normally, devices)
      SelectTagsExpression(context.metaDao, Set(DeviceKey), True),
      // What constitutes an issue
      StatusTreeExpression(
        // The additional tags we care about (we'll be including this in alert data)
        SelectTagsExpression(context.tsDao, Set("name"), withTagsCondition("certificate-expiration")),
        StatusTreeExpression(
          // The time-series we check the test condition against:
          SelectTimeSeriesExpression[Double](context.tsDao, Set("certificate-expiration"), denseOnly = false),
          // The condition which, if true, we have an issue. Checked against the time-series we've collected
          And(
            GreaterThan(
              actualValue,
              NowExpression()
            ),
            LesserThan(actualValue,
                       PlusExpression[TimeSpan](NowExpression(),
                                                getParameterTimeSpanForTimeSeries(highThresholdParameter)))
          )
          // The Alert Item to add for this specific item
        ).withSecondaryInfo(
            scopableStringFormatExpression("${scope(\"name\")}"),
            scopableStringFormatExpression("Will expire on %s", timeSpanToDateExpression(actualValue)),
            title = "Affected Certificates"
          )
          .asCondition()
      ).withoutInfo().asCondition()
    ).withRootInfo(
      getHeadline(),
      ConstantExpression("One or more certificates are about to expire. See the list below."),
      ConditionalRemediationSteps(
        "Renew any certificates that need to be renewed.",
        ConditionalRemediationSteps.VENDOR_CP ->
          """Please review:
            |<a target="_blank" href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104400">Solution sk104400 on Check Point Support Center</a>
            |and the articles to which it links at the bottom.""".stripMargin,
        ConditionalRemediationSteps.VENDOR_PANOS ->
          """Please review this article on Palo Alto Networks Support Site:
            |<a target="_blank" href="https://www.paloaltonetworks.com/documentation/60/pan-os/pan-os/certificate-management/revoke-and-renew-certificates\">Revoke and Renew Certificates</a>.""".stripMargin,
        ConditionalRemediationSteps.VENDOR_FORTINET ->
          """
            |1. Login via ssh to the Fortinet firewall and run the FortiOS command “get vpn certificate <X> detail”  to review the period for which the certificate is valid.
            |2. Login via ssh to the Fortinet firewall and run the FortiOS command “get vpn certificate setting” to review the settings.
            |3. Login via https to the Fortinet firewall and go to the menu System > Certificates tab to review the list of the certificates. Double click each certificate to get detailed information.
            |4. For more information review the Fortinet Certification Configuration Guide: http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-authentication-54/Certificates.htm
            |5. If the problem persists, contact Fortinet Technical support at https://support.fortinet.com/ for further assistance.""".stripMargin
      )
    )
  }
}


pinned #2