iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Preserve evidence first, then contain management access, collect logs, investigate identity and configuration changes, and rebuild from a trusted state. Do not factory-reset, upgrade, or power-cycle a suspected PAN-OS firewall or Panorama appliance until your incident plan and Palo Alto Networks guidance say the required evidence has been captured. The correct recovery path depends on whether the device is a hardware appliance or a virtual machine.
1. Declare the incident and move coordination off the suspected system
Assign an incident commander and open an out-of-band communications channel, such as a trusted phone bridge or separately managed collaboration environment. Do not use a potentially compromised firewall, Panorama appliance, administrator account, or management network to exchange response credentials or decisions.
Record the initial facts
- Write down the suspected start and end of the activity, using an explicit timezone.
- Record the affected firewall and Panorama serial numbers, virtual-machine identifiers where applicable, PAN-OS versions, and management interfaces exposed to the internet or other untrusted networks.
- List suspected source addresses, user and administrator accounts, known indicators of compromise, and the person who first reported the issue.
- Note business-critical services that could be disrupted by isolation.
Unit 42’s emergency response guidance places command, secure communications, evidence-preserving containment, and recovery in that order. Treat the first timeline as provisional; update it as log correlation produces more precise timestamps.
2. Contain management access without destroying volatile evidence
Use a trusted network owner or out-of-band administrator to restrict the PAN-OS or Panorama management web interface to known internal addresses or a dedicated management path. Palo Alto Networks’ CVE-2025-0111 guidance identifies securing management access to trusted internal addresses as an immediate action.
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
Containment checklist
- Block or remove untrusted routes and security-policy rules that expose the management interface.
- Allow administration only from designated jump hosts or management subnets, with the smallest practical source range.
- Preserve the current policy and routing state before changing rules, and record each change with its time and operator.
- Coordinate isolation with the network owner so that critical traffic, logging, and volatile evidence are not unexpectedly lost.
Stop point: Do not press a factory-reset or Enhanced Factory Reset (EFR) control, install an upgrade, or power-cycle the appliance yet. Those actions can remove logs, memory-resident evidence, or configuration history needed to determine what happened. If an immediate safety action is unavoidable, document who authorized it, why it was necessary, and what evidence could no longer be collected.
3. Capture the evidence package before remediation
Export firewall and Panorama evidence beginning two hours before the suspected activity and continuing through the latest available time. The two-hour interval is Palo Alto Networks’ stated collection window for this response scenario; expand it when your timeline or retention allows.
Export the relevant PAN-OS logs
Collect every category that is enabled and relevant to the device:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
- Data Filtering
- Traffic
- Threat
- URL Filtering
- User-ID
- WildFire Submissions
Export from both the individual firewall and Panorama when each holds a copy or a different view of the events. Preserve the original export format rather than relying only on screenshots or a filtered report.
Preserve supporting artifacts
- Technical-support files and the saved device and Panorama configurations.
- Network topology diagrams, management-path details, and relevant security-policy or routing changes.
- Attacker or suspicious IP addresses, domain names, hashes, malware samples, and other indicators of compromise.
- Identity-provider, VPN or GlobalProtect, jump-host, DNS, proxy, endpoint, cloud-audit, and other infrastructure logs covering the same time range.
- Application Command Center (ACC) and Threat Monitor views showing anomalies before and after the suspected window.
Retention and storage capacity matter: overwritten data can make an otherwise sound investigation inconclusive. Record the export time, device identity, timezone, collector, and the person who handled each artifact. Apply your organization’s hash and chain-of-custody procedure so another responder can demonstrate that files were not altered after collection.
4. Investigate administrator and identity misuse
Review PAN-OS and Panorama account activity
Inspect administrator last-login and failed-login indicators in PAN-OS and Panorama. Palo Alto Networks says these fields can show that an account was used by someone else or is being targeted by brute force. Compare the source addresses, timestamps, authentication method, and assigned role with the administrator’s expected activity.
Rank #3
- What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
- Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
- Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
- Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
- Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
Correlate identities across systems
Search identity-provider, VPN, GlobalProtect, jump-host, DNS, proxy, endpoint, and cloud audit logs for the same account, source address, and time. A firewall event that appears to come from a normal administrator address may still represent a stolen session, a compromised jump host, or a token replay. Preserve the original records and normalize timestamps before drawing conclusions.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteIdentity weaknesses played a material role in almost 90% of Unit 42 investigations, according to Palo Alto Networks’ 2026 Global Incident Response Report. That figure describes Unit 42 investigations, not the percentage of PAN-OS suspicions that prove to be compromises; no defensible vendor statistic establishes that latter rate.
Assume exposed secrets when unauthorized access is plausible
If the investigation finds unauthorized access to the management plane, treat the following as potentially exposed until proven otherwise:
Rank #4
- GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
- BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
- EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
- TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.
- Administrator and service passwords
- API tokens and automation credentials
- Pre-shared keys (PSKs)
- Private keys and certificates stored on PAN-OS
- LDAP, RADIUS, or other directory-service secrets
- Cloud, logging, monitoring, and management-integration credentials
- The PAN-OS master key and any data encrypted with it
Do not rotate a secret in a way that erases the old evidence before it is captured. Coordinate emergency changes with the identity or certificate owner, record the exact time of revocation, and plan for dependent systems that may stop authenticating.
5. Choose the correct recovery path: hardware EFR or virtual replacement
The appliance type determines whether you clean the existing system or preserve it and build a replacement. The table below reflects Palo Alto Networks’ remediation direction; downtime and support response times depend on your environment and are not stated by the vendor guidance.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Option | When it applies | Evidence handling | Support involvement | Configuration approach |
|---|---|---|---|---|
| Enhanced Factory Reset on hardware NGFW or Panorama M-Series | Supported physical appliance that is compromised or potentially compromised | Capture the incident package before the reset; retain the original records and reset history | Work with Palo Alto Networks Customer Support for the remediation procedure | Restore only a reviewed, trusted configuration after the reset |
| Replace a virtual NGFW or Panorama | Compromised or potentially compromised virtual appliance | Shut down and preserve the compromised VM and virtual disk for forensic analysis | Coordinate licensing transfer and deployment with the applicable support process | Deploy a new instance and import only a reviewed configuration |
Hardware: use vendor-directed EFR
Palo Alto Networks describes EFR as a complete cleanup of a compromised NGFW. The self-service procedure wipes the system disk, verifies PAN-OS image integrity and model compatibility, reinstalls from images on a prepared USB drive, and appends a summary record to the history log. A generic USB flash drive is not itself a remediation: it is only the physical medium for the vendor-specified images and must meet the current EFR procedure’s capacity, formatting, image, and model requirements.
Best Value
- 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
- 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
- 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
- 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
- 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.
Use the current Palo Alto Networks procedure and Customer Support instructions for the exact model. Do not assume that a configuration export, software upgrade, or ordinary factory reset provides the same cleanup guarantees as EFR.
Virtual appliance: preserve, replace, then decommission
- Shut down the compromised virtual appliance in a controlled way that preserves its virtual disk and associated forensic metadata.
- Secure a copy or snapshot according to your evidence policy; do not boot the preserved copy for routine administration.
- Deploy a new NGFW or Panorama instance, transfer licensing as applicable, and place it on an isolated management path.
- Restore only a configuration that has been reviewed against a trusted baseline.
- Validate the replacement before reconnecting production traffic.
- Decommission the old VM only after forensic analysis, legal holds, and incident-commander approval are complete.
6. Rebuild from a trusted state and rotate every exposed secret
Review configuration provenance
Compare the saved configuration with a version-controlled or otherwise approved baseline. Look for new administrator accounts, changed role assignments, altered authentication settings, management-interface exposure, modified security or NAT rules, unexpected routing, new certificates, logging changes, and unfamiliar scheduled or automation-related settings. If you cannot establish provenance or explain every material change, prefer a clean rebuild over importing the entire file.
Reset encryption and credentials
- Change the PAN-OS master key and configure the encryption level specified in the applicable Palo Alto Networks guidance; the CVE-2025-0111 FAQ names AES-256-GCM.
- Reset every administrator and service password, including accounts that show no suspicious login.
- Reissue API tokens, automation secrets, PSKs, LDAP or RADIUS credentials, and cloud or management-integration credentials.
- Revoke and reissue certificates whose private keys were stored on PAN-OS; distribute the new certificates to dependent systems and remove trust in the old ones.
- Invalidate sessions and cached credentials where the identity provider or management system supports it.
Change secrets in a coordinated sequence so that authentication failures do not cause an avoidable outage. Keep a dated rotation record in the incident file.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Install a fixed PAN-OS release
Update to the fixed PAN-OS version identified in the applicable Palo Alto Networks security advisory. Release numbers change as advisories are revised, so use the current advisory for the affected CVE and platform rather than copying a version from an older checklist. Verify image integrity, model compatibility, support status, and configuration compatibility before installation.
7. Validate before returning the firewall to production
Technical validation
- Compare the rebuilt configuration with the approved baseline and obtain a second-person review.
- Check every administrator account, role assignment, authentication source, and management-interface rule.
- Confirm that Traffic, Threat, URL Filtering, User-ID, Data Filtering, and WildFire logging required by your design are enabled.
- Verify forwarding destinations, timestamps, time synchronization, retention, and alerting in Panorama, SIEM, and other monitoring systems.
- Test critical security policies, routing, NAT, VPN or GlobalProtect access, and failover in an isolated or maintenance environment.
Broader compromise hunt
Use the firewall’s verified timestamps and indicators of compromise to search endpoints, identity systems, VPN and GlobalProtect infrastructure, cloud services, and downstream network segments. Investigate whether an attacker moved laterally or reused a firewall credential elsewhere. Keep the original evidence package separate from the rebuilt device and retain the EFR summary or virtual-appliance replacement records.
Controlled reconnection
- Schedule a maintenance window with the service owners.
- Reconnect the device through the restricted management path first.
- Watch administrator activity, authentication events, Threat logs, ACC, and forwarding health continuously during the initial period.
- Restore broader production connectivity only after the monitoring checks pass.
- Document lessons learned, control changes, required notifications, and any legal or regulatory review.
When to involve Palo Alto Networks or an incident-response firm
Escalate to Palo Alto Networks Customer Support for hardware EFR and platform-specific recovery instructions. Consider Unit 42 or another qualified incident-response provider when internal forensic capability is limited, evidence volume is large, the incident is urgent, legal or regulatory preservation is required, or you need an independent compromise assessment. Preserve the device and logs before handing them over, and define who owns the evidence, communications, and final rebuild decision.
Quick Recap
Common mistakes that make a PAN-OS investigation harder
- Resetting first: destroys or truncates the very logs and state needed to establish scope.
- Using the compromised management channel: exposes response credentials and lets an attacker observe containment.
- Collecting only Traffic logs: misses identity, threat, URL, data-filtering, and WildFire context.
- Trusting an old configuration export blindly: imports attacker changes and possibly encrypted secrets.
- Rotating only the administrator password: leaves tokens, PSKs, private keys, certificates, and integration credentials usable.
- Treating a generic USB drive as EFR: ignores the image, formatting, integrity, and model requirements in the current vendor procedure.
- Deleting a compromised VM immediately: removes the virtual disk that may be needed for forensic analysis.
- Reconnecting without monitoring: allows renewed access or persistence to go unnoticed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
