Palo Alto Networks Cortex Data Lake provides cloud-based, centralized log storage and aggregation for firewalls and services. With Cortex Data Lake, Palo Alto Networks takes care of the ongoing maintenance and monitoring of your logging infrastructure so that you can focus on your business.

Until PAN-OS^® 9.0.3, Panorama was required to onboard firewalls to Cortex Data Lake and to view logs stored in Cortex Data Lake. Now, with PAN-OS 9.0.3 and later releases, you can enable non-Panorama managed firewalls to securely connect and send logs to Cortex Data Lake.

Visually group related rules using a new group tag to efficiently manage large sets of related rules within any policy rulebase. You can use any tag as a group tag to organize related rules so that you can easily move, clone, or delete the rules in the selected group. This allows you to visually see the organizational changes that are happening to your rulebase, and increase the efficiency of managing large sets of rules.

When auditing your rulebase, you can now filter and quickly identify unused rules to manage policy rules. Removing unused rules improves your security posture by reducing the proliferation of rules. For example, when transitioning from port-based rules to App-ID™ based rules, this information enables you to assess whether your App-ID based rules are matched instead of your port-based rules so that you can remove the unused rules.

To help you scale your deployment and ease the migration to Palo Alto Networks firewalls, the PA-5220 and the PA-3200 Series firewalls have increased capacities for several objects, including increases in the number of address objects, address groups, service groups, service objects, zones, and policy rules.

If you are using the firewall or Panorama APIs to enable programmatic access, you can now specify the API key lifetime to match the automation task duration and control the validity period for an authenticated and secure connection between the firewall/Panorama and the automation program or service. Because each API call requires the API key, using a key with a limited lifetime allows you to enforce key rotation at a regular cadence to safeguard your network and adhere to compliance standards. You can also expire all API keys simultaneously, if you suspect accidental exposure or a leak.

In addition to the existing XML API, the firewalls and Panorama now support a REST API for a more simplified API integration. With the REST API, the firewall is represented as a set of resources with URIs on which you can perform operations that allow you to easily map firewall tasks to the API interface. For example, Security policy is represented as a REST resource with URI /restapi/9.0/Policies/SecurityRules and has a list of operations that includes list, create, edit, delete, move, and rename. The REST API provides the flexibility to use JSON and XML data formats in API requests and responses, and supports versioning for backward compatibility with future PAN-OS releases. The initial release of this API allows you to manage the configuration of policies and objects on the firewall and Panorama and provides reference documentation that is built in to the product.

To simplify auditing, searching, reporting, and tracking for configuration changes to rules, universally unique identifiers (UUIDs) are created for all policy rulebases that you create on the firewall or push from Panorama. If you rename or delete the rule, the UUID ensures that the rule’s history of changes is maintained. The UUID can pinpoint the rule across multiple rulebases containing thousands of rules that may have similar or identical names, and simplifies automation and integration for rules into third-party systems (such as ticketing or orchestration) that do not support names.