Palo Alto Strata NGFW

No entries match these filters. Clear filters

1. docs update Sep 23, 2026 · issue 083

   DNS Security Operator Dashboard in Strata Cloud Manager surfaces C2 traffic, malicious domains, and at-risk users/devices in one view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Investigate C2 domain traffic and identify which users or devices are reaching malicious domains — use the dashboard as your starting point before drilling into specific incidents.
   📍In Strata Cloud Manager, go to DNS Security › Operator Dashboard to view top malicious domains, C2 domain traffic, and users/devices accessing malicious domains.
2. docs update Sep 22, 2026 · issue 082

   Advanced DNS Security Resolver gains DoTDoTDNS over TLS: an IETF standard (RFC 7858) that wraps DNS queries in a TLS session on port 853, preventing eavesdropping and tampering that plain UDP DNS allows. support, three new PoPs, a remote-access domain category, and a new Operator Dashboard in Strata Cloud Manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds remote-access domain category to DNS Security policy, enabling discrete block/allow actions for remote-access tool download sites such as TeamViewer, AnyDesk, and LogMeIn.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports DNS over TLSDNS over TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. (DoT) query processing on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 853 (RFC 7858) in the Advanced DNS Security Resolver, with TLS 1.2 minimum and TLS 1.3 preferred, alongside existing DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. support.
   • Adds Point of Presence (PoP) service regions in Spain, Italy, and Switzerland to the Advanced DNS Security Resolver, with automatic client routing to the nearest regional endpoint.
   • Introduces the DNS Security Operator Dashboard in Strata Cloud Manager, surfacing top malicious domains, C2 domain traffic, and users/devices accessing malicious domains with drill-down analysis.
   • Adds remote-access domain category to DNS Security policy, enabling discrete block/allow actions for remote-access tool download sites such as TeamViewer, AnyDesk, and LogMeIn.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports DNS over TLSDNS over TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. (DoT) query processing on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 853 (RFC 7858) in the Advanced DNS Security Resolver, with TLS 1.2 minimum and TLS 1.3 preferred, alongside existing DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. support.
   • Introduces the DNS Security Operator Dashboard in Strata Cloud Manager, surfacing top malicious domains, C2 domain traffic, and users/devices accessing malicious domains with drill-down analysis.

   1 more in Everything

3. docs update Aug 28, 2026 · issue 058

   Strata Cloud Manager gains automated discovery and topological visualization of Cloud NGFW for Azure deployments.

   • Strata Cloud Manager now auto-discovers and visualizes existing and newly deployed Cloud NGFW for Azure firewall resources in a unified topological view, mapping network dependencies across Azure infrastructure.

   1 detail in Everything

4. docs update Aug 1, 2026 · issue 032

   PAN-OS 12.2 Ceres adds Advanced IP Defense, post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. crypto for GlobalProtect, PAN-OS Shield, OT microsegmentation, and Cloud NGFW Premium instances.

   • New PAN-OS Shield protects the firewall itself against attacks on PAN-OS using the built-in Threat Prevention engine with one-click enablement — securing GlobalProtect gateway and portal without a separate Threat Prevention license.
   • PAN-OS 12.2 adds post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. support for GlobalProtect, providing quantum-resistantquantum-resistantCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnels.
   • PAN-OS 12.2 introduces intent-based configuration management for declarative, AI-driven policy authoring.
   • PAN-OS 12.2 adds proactive OT microsegmentation to isolate operational technology environments before incidents occur.
   • Cloud NGFW for Azure now supports Premium instances, offering up to 200 Gbps peak throughput and larger policy sets; existing Standard firewalls can be self-service upgraded to Premium.

   +1 more show less

   • Cloud NGFW for Azure now integrates with Enterprise Data Loss Prevention (E-DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.), enabling centralized DLP pattern and profile management via Panorama across cloud infrastructure; onboarding is automated when a Cloud NGFW resource is added to a Strata Tenant (TSG).

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Cloud NGFW for Azure exclusively supports E-DLP going forward; all data-filtering profiles configured in Panorama are treated as E-DLP usage and will be billed at the E-DLP rate.
5. docs update Jul 31, 2026 · issue 031

   PAN-OS 12.2 introduces Advanced IP Defense, post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. for GlobalProtect, and PAN-OS Shield among other capabilities.

   • Adds Advanced IP Defense: real-time Precision AI blocks attacker internet infrastructure inline, enforces Zero-Trust DNS validation on every outbound connection, and scores public IPs across 40+ security attributes to stop proxies and anonymizers.
   • Adds PAN-OS Shield: one-click enablement uses the built-in Threat Prevention engine to protect GlobalProtect gateways and portals against attacks on PAN-OS itself, requiring no additional Threat Prevention license.
   • Adds post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. cryptography support for GlobalProtect to defend VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnels against future quantum-based decryption attacks.
   • Adds intent-based configuration management for automated, policy-driven NGFW configuration.
   • Adds proactive OT microsegmentation for operational technology network isolation.

   +2 more show less

   • Adds NGFW-native Prisma Browser identification for browser-level visibility directly from the firewall.
   • Adds Threat Prevention protections specifically targeting attacks against GlobalProtect.

   7 details in Everything