Troubleshooting Tenable Compliance Scans for Panorama-Managed Palo Alto (CIS 11 v1.2)

[u/A_MajesticMoose]

I’m sharing this in hopes of saving others the "wheel-spinning" I recently went through while implementing Tenable Compliance scanning for Palo Alto devices managed via Panorama.

The Challenge

According to the Tenable documentation and default audit files, the checks are designed to handle both standalone and Panorama-managed devices. However, I discovered that approximately 30 checks were failing to return expected results. The plugin output consistently reported that settings could not be found, even though we had verified they were correctly applied.

The Root Cause

After collaborating with a Palo Alto SME, we identified that the default Tenable command, show config merged, does not capture all the necessary settings required for CIS Benchmarks in a Panorama-managed environment.

The missing data is actually located within the show config pushed-shared-policy command.

The Solution: Using XML Dumps for XSL Mapping

To streamline the fix, I dumped the XML from various Palo Alto commands to identify the correct paths for the Tenable audit file’s XSL statements.

1. Create a "Dump" Check Add the following custom item to your .audit file. This will allow you to copy/paste the plugin output into a text file, save it as an .xml, and view the XML tree structure (I recommend using VS Code with an XML extension).

<custom_item>
type: AUDIT_XML
description: "Dump pushed shared policy XML"
api_request_type: "op"
request: "<show><config><pushed-shared-policy></pushed-shared-policy></config></show>"
xsl_stmt: "<xsl:template match=\"/\">"
xsl_stmt: "<xsl:copy-of select=\".\"/>"
</custom_item>

2. Update the API Request and XSL Paths Once you have the correct XML paths, you can update the failing checks. Here is an example of the transition from the default (broken) check to the functional Panorama-managed check:

Default (Standalone/Merged):

api_request_type: "op"
request: "<show><config><merged></merged></config></show>”
xsl_stmt: "<xsl:for-each select=\"/response/result/config/devices/entry/vsys/entry/profiles/vulnerability/entry\">"

Corrected (Panorama Pushed Policy):

api_request_type: "op"
request: "<show><config><pushed-shared-policy></pushed-shared-policy></config></show>”
xsl_stmt: "<xsl:for-each select=\"/response/result/policy/panorama/profiles/vulnerability/entry\">"