Palo Alto Config Backup, Log Forwarding & Security Audit

Purpose

This document covers three related Palo Alto operational topics: automated configuration backup, centralized log forwarding architecture, and automated security auditing of firewall configurations.

1. Automated Config Backup (Operational)

Architecture

Azure Functions and Lambda functions deployed in each management subnet export configs daily and commit to the palo-alto-configs repo via the GitHub API. GitHub Actions runners are not used for this — firewall management IPs are private and the compute running the backup must be on the same network as the management interface.

Azure Management Subnet          AWS Management Subnet
┌──────────────────────┐        ┌──────────────────────┐
│  Azure Function       │        │  Lambda Function      │
│  (daily cron)         │        │  (daily cron)         │
│  Private IP access    │        │  Private IP access    │
│  to mgmt interface    │        │  to mgmt interface    │
└──────────┬───────────┘        └──────────┬───────────┘
           │                               │
           │  PAN-OS XML API               │  PAN-OS XML API
           │  (HTTPS to private IP)        │  (HTTPS to private IP)
           └──────────────┬────────────────┘
                          │
                     S3 intermediate
                    (audit/backup decoupled)
                          │
                   GitHub API (HTTPS)
                          │
                          ▼
              palo-alto-configs repo
              firewall-configs/
              ├── azure-prod/running-config-YYYY-MM-DD.xml
              ├── azure-dashboard/running-config-YYYY-MM-DD.xml
              ├── dde/running-config-YYYY-MM-DD.xml
              └── aws-dr/running-config-YYYY-MM-DD.xml

Backup and audit jobs are decoupled via S3 intermediate — the same pattern used for the AD audit workflow. This prevents a single job failure from blocking both backup and audit.

Config Export via PAN-OS XML API

Each firewall has a dedicated service account with the super-reader role (read-only). The API key is stored in Azure Key Vault or AWS Secrets Manager — never in code or GitHub secrets in plaintext.

bash

# Export running config
curl -k "https://<firewall-mgmt-ip>/api/?type=export&category=configuration&key=<api_key>" \
  -o running-config-$(date +%Y-%m-%d).xml

Change Detection & Alerting

The backup function compares the new config to the previous commit. If changes are detected, it sends a diff summary via SES with the changed sections, firewall hostname, and link to the GitHub commit.

High-risk change categories that trigger immediate notification:

Security policy additions, deletions, or modifications
Zone configuration changes
Admin account changes
SSL/TLS decryption policy changes

CI/CD Trigger Isolation

The palo-alto-configs repo uses paths-ignore in all GitHub Actions workflow triggers. Config commits are archive-only — they do not invoke Terraform or any deployment workflow.

Implementation Status

Component	Status
Azure Function in mgmt subnet	✅ Operational
Lambda in AWS mgmt subnet	✅ Operational
Daily cron config export	✅ Operational
Change detection alerting via SES	✅ Operational
S3 intermediate decoupling	✅ Operational
paths-ignore in CI/CD	✅ Configured

2. Firewall Log Forwarding Architecture

Current State

All four firewalls have syslog forwarding active with Arctic Wolf VLC ingestion confirmed. Archive shipping via syslog VMs is operational.

Firewall	Syslog VM	Arctic Wolf (VLC)	Archive Forwarding
Azure production	✅ Active	✅ Active	✅ Via syslog VM
Azure dashboard	✅ Active	✅ Active	✅ Via syslog VM
DDE customer-facing	✅ Active	✅ Active	✅ Via syslog VM
AWS DR	✅ Active	✅ Active	✅ Via syslog VM → S3

All four VLCs confirmed showing active ingestion in Arctic Wolf portal as of March 2026.

Log Types Captured

Log Type	Contents	HIPAA Relevance
Traffic	All permitted and denied sessions	Network activity audit trail
Threat	IPS, antivirus, anti-spyware, URL filtering events	Threat detection evidence
Authentication	Admin authentication events	Access control audit
System	HA failover, software updates, hardware events	Operational integrity
Config	Configuration changes with admin username and timestamp	Change management audit
HIP Match	Host Information Profile results	Endpoint compliance evidence

Log Forwarding Architecture

Palo Alto Firewall
       │
       ├──── Syslog ────► Syslog VM (per environment)
       │                       │
       │                       ├──► Arctic Wolf SIEM (VLC)
       │                       │    (~1 year active retention)
       │                       │
       │                       └──► Azure Storage / S3 Archive
       │                            (WORM / Object Lock, 6-year retention)
       │
       └──── Config backup (daily) ────► Azure Function / Lambda
                                              │
                                         palo-alto-configs repo

3. Automated Firewall Security Audit (Operational)

Custom XML-Parsing Checks (Weekly)

pan_analyzer (palo_alto_firewall_analyzer) has no reliable pip-installable package. Custom XML-parsing checks provide equivalent functionality and run weekly against exported configs.

What the checks detect:

Unused security rules (no hit count in 90 days)
Overly permissive rules (any/any source or destination)
Rules missing security profiles (antivirus, anti-spyware, vulnerability, URL filtering)
Zone misconfigurations
Admin accounts with excessive permissions

How they run:

Operate against XML exports in the palo-alto-configs repo — no live firewall access required
GitHub Actions workflow runs weekly
Output committed to repo and emailed via SES as part of the compliance audit pipeline

Palo Alto Best Practice Assessment (Quarterly)

The BPA is a Palo Alto-provided tool that runs 200+ checks against firewall configuration.

Upload config XML to the Palo Alto Customer Support portal manually (quarterly cadence)
BPA evaluates: threat prevention adoption, URL filtering, SSL decryption, WildFire, security profile completeness
Results provide a pass/fail score per check with priority-ordered remediation guidance
BPA reports stored in the compliance evidence repository
Quarterly review process established as of March 2026

Custom HIPAA Policy Checks (Quarterly)

Check	HIPAA Relevance
PHI network segments have deny-by-default policies	§164.312(a) Access Control
Production and development have no direct connectivity	§164.312(a) Access Control
All rules have security profiles attached	§164.312(b) Audit Controls
Zero-hit rules removed or justified	Policy hygiene
Admin accounts reviewed, least privilege verified	§164.312(a) Access Control

Reporting Cadence

Tool	Frequency	Delivery
Custom XML checks	Weekly	Email via SES (HIPAA audit pipeline)
BPA	Quarterly	Manual upload, report in evidence repo
Custom HIPAA policy checks	Quarterly	Documented in bedrock-docs

Document History

Date	Change	Author
March 2026	Updated config backup status to Operational across all components; added S3 intermediate decoupling note; updated log forwarding to reflect all four VLCs active and archive shipping operational; updated security audit to Operational with custom XML-parsing checks replacing pan_analyzer; updated BPA quarterly review as established	Rory
March 2026	Initial draft — config backup architecture, log forwarding current state, security audit tooling	Rory

Palo Alto Config Backup, Log Forwarding & Security Audit ​

Purpose ​

1. Automated Config Backup (Operational) ​

Architecture ​

Config Export via PAN-OS XML API ​

Change Detection & Alerting ​

CI/CD Trigger Isolation ​

Implementation Status ​

2. Firewall Log Forwarding Architecture ​

Current State ​

Log Types Captured ​

Log Forwarding Architecture ​

3. Automated Firewall Security Audit (Operational) ​

Custom XML-Parsing Checks (Weekly) ​

Palo Alto Best Practice Assessment (Quarterly) ​

Custom HIPAA Policy Checks (Quarterly) ​

Reporting Cadence ​

Document History ​

Related Documentation ​