--- sourceDocument: Xanadu Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/security-management Release : - xanadu ft:locale : - en-US ft:publication_title : - Xanadu Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Set up and install Palo Alto Networks Next-Generation Firewall # Set up and install Palo Alto Networks Next-Generation Firewall {#ariaid-title1} * Release version: Xanadu * * Updated August 1, 2024 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Complete the following setup checklist prior to installation. These setup tasks are required for a smooth installation. ## Before you begin Role required: (admin){#paloalto_install__table_xxz_jyj_4cb__entry__2} | Setup task | Description | |-|-| | Verify that you have the required ServiceNow AI Platform and Security Incident Response roles assigned. | The following roles are required: * The System Administrator (admin) installs the app and assigns the Security Incident Administrator (sn_si.admin) role. * The Security Incident Administrator (sn_si.admin) oversees the configuration, and creates, activates, and removes EDLs. This role also assigns the sn_si.analyst role. * The (admin) assigns the ServiceNow AI Platform® API account role (sn_sec_panfw.api_account_access), which is used exclusively for entering credentials required for authentication on Palo Alto Networks so the firewalls can retrieve EDLs from the ServiceNow AI Platform®. * (sn_si.analyst), or Security Operations Center (SOC) Analyst, creates EDL entries and works with security incidents. {#paloalto_install__ul_wnc_15r_tcb} | | Verify that you are using Palo Alto Networks Next-Generation Firewall version-OS 9.x, and 10.x. | This integration only supports Palo Alto Networks Next-Generation Firewall OS 9.0 and later. | | Set up any EDL profiles, security policy rules, and certificate profiles in Palo Alto Networks as recommended in Palo Alto Networks documentation. | Refer to Palo Alto Networks general documentation and requirements at the: [Paloalto Networks Documentation website](https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin). | | Verify that you have downloaded and configured the DigiCert Root Authority Certificate. | The integration requires this certificate to validate and authenticate the secure connection between the ServiceNow AI Platform server and the Palo Alto Networks Next-Generation Firewall server. For more information on setting up the certificate, see ["Configure a Certificate Profile" in the PAN-OS 10.0 Administrator's Guide](https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/certificate-management/configure-a-certificate-profile). For the download, see [Create a certificate profile for the Palo Alto Networks Next-Generation Firewall](https://www.servicenow.com/docs/EypHhcDf2rXcmfePSFiPhA "The integration requires a certificate profile to validate and authenticate the secure connection between the ServiceNow AI Platform server and the Palo Alto Networks Next-Generation Firewall server.") and [DigiCert Trusted Root Authority Certificates](https://www.digicert.com/kb/digicert-root-certificates.htm). | | Verify that the ServiceNow core applications that are required to support the integration are installed and activated before you install the application for the integration. | Madrid and later release requirements For the Madrid release and later family releases, the Security Incident Response Dependency plugin (com.snc.si_dep) is required. This plugin automatically installs all the dependencies that are required to support the Security Incident Response product. Install and activate this plugin before you install and activate the other Security Operations applications required by the integration. Verify that the following Security Operations applications are installed and activated from the ServiceNow Store. If not installed, install and activate one application at a time in the following order to ensure a smooth installation. 1. Security Incident Response 2. Security Integration Framework 3. Security Support Common 4. Security Support Orchestration {#paloalto_install__ol_qwy_vrt_fhb} For more information on setting up your ServiceNow AI Platform instance for the integration, see [Get entitlement for a Security Operations product or application](https://www.servicenow.com/docs/EuIstpyLSbg5yLNaGpGURg "The first step in installing a Security Operations application is to verify that the application or the product and its associated applications have valid ServiceNow entitlements.") and [Activate a ServiceNow Store application](https://www.servicenow.com/docs/0MywJIMcl~fLN9sNG1RJww "After an application has been given entitlement, you must activate its dependencies plugin and activate the application. This process also applies to applications downloaded to sub-production instances."). | | If your organization has ServiceNow AI Platform® change management and approval processes for email deletion, verify that email send/receive capability is enabled. | To verify that email send/receive capability is enabled in your ServiceNow AI Platform® instance, navigate to Email propertiesAdministrationEmail Properties. In Outbound Email Configuration, verify Email sending and Email receiving are selected. | [ ] {#paloalto_install__table_xxz_jyj_4cb} ## Procedure If you have not installed the application for the integration, see [Install a Security Operations integration](https://www.servicenow.com/docs/hKAhlPYreboSlsmsZCS3nA "All ServiceNow integrations are available on the ServiceNow Store. Core applications, such as Security Incident Response, are visible in the ServiceNow Products tab on the store. Integration add-ons are visible in the Certified Apps tab.") and follow the steps to install it. **Previous topic:** [Create a certificate profile for the Palo Alto Networks Next-Generation Firewall](https://www.servicenow.com/docs/EypHhcDf2rXcmfePSFiPhA "The integration requires a certificate profile to validate and authenticate the secure connection between the ServiceNow AI Platform server and the Palo Alto Networks Next-Generation Firewall server.") **Next topic:** [Create the API account role for Palo Alto Networks Next-Generation Firewall](https://www.servicenow.com/docs/09eKFa9dHglremdpVq8AaA "An API account role is required in your ServiceNow AI Platform instance for this integration. The Username and Password associated with this account are created in the ServiceNow AI Platform and entered in Palo Alto Networks so the Palo Alto Networks Next-Generation Firewall authenticates with the ServiceNow AI Platform when retrieving EDL entries.") *[\>]: and then