Palo Alto - Panorama Firewall Management Integration with TEM

Overview

Check Point Threat Exposure Management (TEM) integrates with Palo Alto Panorama Firewall Management by delivering Indicators of Compromise (IoCs) to its centralized management layer, ensuring consistent threat intelligence and policy enforcement across all managed Next Generation Firewalls (NGFWs).

Administrators must enable Threat Prevention security profiles (including Vulnerability Protection, Anti-Spyware, and IPS features) on all managed firewalls and configure Log Forwarding to Panorama for centralized visibility, logging, and policy enforcement across the Palo Alto firewall infrastructure.

  1. IPS Enforcement

    Administrators must enable Intrusion Prevention System (IPS) enforcement on the Panorama-managed Firewalls (FWM) to ensure that threat protections are applied consistently across all managed devices.

    Traffic-Based Insights

    • IPS logs capture real-time threat activity, including intrusion attempts, exploit signatures, and suspicious payloads.

    • TEM uses these logs to correlate traffic patterns and surface risk-based exposures.

    Log Requirements

    • Enable IPS and actively log events.

    • Retain logs for at least 7 days and ensure TEM can continuously access them for analysis.

    To verify IPS Enforcement logs, see Verifying IPS Enforcement Logs for TEM.

  2. Access Policy Rules for TEM - For All Supported Panorama Firewall Management Deployments

     

    Source

    Destination

    Port

    Protocol

    Purpose

    Palo Alto

     

     

     

     

    TEM VM

    Panorama Server

    TCP/443

    HTTPS

    Configuration Fetch / Remediations

    TEM VM

    Panorama Server / Log Collector

    TCP/443

    HTTPS

    Logs Fetch

    Panorama Server / Log Collector

    TEM VM

    TCP/30030

    TCP

    Logs Fetch

    Firewalls / Clusters

    TEM VM

    TCP/30003

    TCP

    IoC Enforcement

    TEM VM

    Firewalls / Clusters

    UDP/161

    SNMP

    CPU and RAM

Supported Capabilities

TEM supports the following capabilities as part of its integration with Panorama Firewall Management:

  • Protection Hardening - Controlled Transition of IPS protections to Block mode strengthens security while minimizing operational impact.

  • Attack Analysis - Uses machine learning to identify real attacks and provides one-click remediation to contain threats quickly.

  • Security Hygiene - Keeps systems updated with the latest patches and security updates to reduce vulnerabilities.

  • Business Disruption Prevention - Detects and mitigates security events that could disrupt operations, helping maintain continuity.

  • Indicators - Manages threat intelligence across all integrated security controls, ensuring consistent alignment and protection across the organization.

    Note - Supported indicator types include IP Addresses and Domains.

Integrating Palo Alto - Panorama Firewall Management with TEM

Step 1: Configuring a New Panorama Administrator Profile for a TEM User

To configure a new Management API Profile for a TEM user:

  1. Log in to Panorama.

  2. On the top toolbar, click Panorama.

  3. From the left navigation panel, click Admin Roles.

  4. Click Add to create a new Admin Role Profile and enter the following details:

    1. Name: TEM Profile

    2. Role: Panorama

    3. XML API: Select the following permissions:

      • Log

      • Configuration

      • Operational Requests

      • Commit

  5. Click OK.

  6. From the left navigation panel, click Administrators.

  7. Select the user created for TEM, assign the newly created profile, and click OK.

  8. On the top navigation panel, click Commit to Panorama to apply the changes.

Step 2: Configuring the TEM Portal

  1. Log in to the TEM portal.

  2. Navigate to Settings > Integrations > Catalog > Panorama Firewall Management.

  3. In the Panorama Firewall Management pop-up that appears, navigate to the Connection tab.

  4. Choose a User Configuration Method:

    1. In the User Configuration section, choose Create a new user on your own option and click Next.

      In the Connection Details section, enter the following details and click Next.

      1. In the Host field, enter the hostname or IP address of the system you are connecting to.

      2. In the Username field, enter the admin name to authenticate the connection.

      3. In the Password field, enter a secure password for the specified username.

      4. (Optional) In the Configuration section, enable Backfill Indicators to import existing indicators into the integration.

      5. Click Connect to establish a connection.

    2. In the User Configuration section, choose Allow Veriti to create a new user option and click Next.

      In the Connection Details section, enter the following details and click Next.

      1. In the Host field, enter the hostname or IP address of the system you are connecting to.

      2. In the Username field, enter the admin name to authenticate the connection.

      3. In the Password field, enter a secure password for the specified username.

      4. (Optional) In the Configuration section, enable Backfill Indicators to import existing indicators into the integration.

      5. Click Connect to establish a connection.

Limitations

  1. REST API users

    REST API users are not supported in this deployment.

  2. High Availability (HA):

    HA environments are not supported for this deployment.

  3. Panorama Cloud Management:

    Panorama Cloud Management is not supported.

  4. SNMP

    SNMP configuration through templates is not supported.

Verifying IPS Enforcement Logs for TEM

Prerequisite:

User Creation Requirements:

  • Automatic User Creation requires a Panorama user with the panorama-administrator profile.

  • Manual User Creation requires a Panorama user with a dedicated user profile.

Notes -

  • This permission is required only for the initial integration (one-time use). After the initial setup, you can create a dedicated profile instead of using the panorama-administrator profile.

  • Authentication profiles are not supported; ensure that the specified administrator account has no profile assigned.

Setting the Log Retention Rate for TEM

  1. Log in to Panorama.

  2. From the top navigation panel, click Monitor > Threat.

  3. In the search bar:

    1. Set the time range to Last 7 Days.

    2. Enter threat-type eq vulnerability

Note - If IPS logs are unavailable, create a dedicated IPS profile set to Alert mode only. This allows TEM to collect traffic data and generate insights without blocking traffic, ensuring complete visibility into potential exposures while keeping business operations uninterrupted.