What's New

Existing predefined or custom Panorama URL categories can be inserted directly into access requests, enabling you to further leverage the automation capabilities of SecureChange:

• Intelligent firewall target selection reduces the need for manual interventions and do-overs.

• TOS automatically verifies if the requested access to the URL category has already been implemented and closes requests, which have already been implemented to ensure optimal resource utilization.

• Use Designer to more easily design changes to enable access to the requested URL category.

• Provision the designed changes to the policy to ensure accurate implementation.

Furthermore, you can leverage the topology map to troubleshoot connectivity to URLs, empowering your administrators to easily identify and resolve network issues, and get a more comprehensive view of shadowed rules with URL categories.

You can perform path analysis queries using the internet object as either the source or destination. This provides you with enhanced visibility of your network, and improves troubleshooting for network objects going to/from the internet.

In addition, you can insert internet objects directly into Check Point and Stonesoft devices in Access Request workflows to implement more secure and accurate access request changes.

If you have a tiered license (SecureTrack+, SecureChange+, or Enterprise), you can now view detailed information on the licenses installed in your system. The old legacy License Management page was replaced with a more modern user interface which shows only the information required to understand the license status of your TOS deployment. This includes the license tier you purchased as well as important license information, such as when it expires. The license tier is now enforced by the product.

The new License Management page is only available to SecureTrack Super Administrators.

In June 2024, RHEL/CentOS 7 are going to be EOL (end of life), as well as TufinOS 3 which is based on CentOS 7. TufinOS 4 and Red Hat Enterprise Linux/Rocky Linux 8.6 are the new supported operating systems for TOS Aurora. These operating systems are available for both clean installs and upgrades on virtual machines and appliances - deployed on-premises. For cloud deployments, only Rocky Linux 8.6 will be supported.

The 2023 support of these operating systems provides you with longer coverage and will enable you to plan the move to the new operating system well before your existing operating system becomes EOL in 2024.

You can use TOS Aurora to monitor Palo Alto Networks Prisma Access Policies managed by Panorama devices, offering you enhanced control and visibility into these polices with Tufin's built-in reports.

With TOS support for Prisma Access Policies you can also:

• Save valuable time and effort in identifying rules via the Rule Viewer

• Compare revisions in SecureTrack to reduce effort when it comes to change tracking

• Streamline cleanup processes using Tufin’s Automated Workflows - Clone Network Object Policy, Network Object Decommission, and Rule Decommission

• Simplify the certification process using the Rule Recertification workflow.

• Empower your firewall administrators to modify rules and groups via auditable workflows such as Group Modification and Rule Modification.

• Automate Access Requests in non-topology mode to avoid risks and reduce the time it takes implement network changes.

In addition, being able to monitor Prisma Access Policies with TOS will eliminate the need to manually prepare for audits on these policies and manually perform time consuming and error-prone policy changes. You will now be able to take full advantage of TOS Aurora's automation capabilities for this device.

A new API sets a zone as the URL Category zone for path calculation and target selection. User networks and Unassociated Networks zones cannot be used as the URL Category zone.

A new GraphQL query returns all changes made in a selected revision that affect the requested rule.

A new API retrieves NAT information for security rules in a specific revision. Previously, obtaining NAT information for security rules was limited to the last revision fetched from the device.

You can use the SecureApp Rest API to get network objects by IP address, subnet and comment - in addition to name. This enhancement further aligns the REST API capabilities with that of the SecureAPP User Interface.

Two API functions have been enhanced:

• network_objects allows you to search all applications for network objects by their IP address

• /applications/{applicationId:0-9}+/network_objects allows you to search a specific application for network objects.

There is a new API function: server_lookup

This API function allows you to get network objects according to the subnet the server is located in, the server’s IP address, or comment.

SecureCloud now displays a risk assessment for assets exposed to the internet based on the data returned from the firewalls monitored by SecureTrack. With this information you will be able to perform more accurate risk assessments based on the aggregated data collected from cloud-native controls as well as virtual firewalls deployed in the cloud. This will result in a reduction of false positive risk assessments (both from Tufin and third-party vendors) and an overall improvement to the general effectiveness of risk prioritizations.

The Extension Apps have been added to the SecureChange navigation menu, enabling you to easily navigate from TOS to your installed apps. If an app is not installed, you will be redirected to a page where you can learn more about it.