
Summary
The detection rule titled 'Host Without Firewall' focuses on identifying hosts that do not have a firewall installed, which is an essential security measure for protecting systems from unauthorized access and various threats. This rule utilizes data from the Qualys vulnerability scanner and specifically looks for security policy events where a firewall product is not detected on the host. When the condition is met, it generates an alert indicating non-compliance with security standards. The associated alerts are categorized as low severity, reflecting a potential vulnerability that can be mitigated by implementing necessary firewall controls. This rule is relevant for organizations looking to adhere to industry standards such as those outlined by the Center for Internet Security (CIS) and PCI Security Standards Council. Effective deployment of this detection can help improve the overall security posture by ensuring firewalls are in place across all hosts.
Categories
- Infrastructure
- Endpoint
- Cloud
- On-Premise
Data Sources
- Volume
- Network Traffic
- Application Log
Created: 2019-03-19