What's New in TOS 5

TOS now supports Microsoft Entra ID as a user identity provider, alongside on-prem Active Directory - so Entra ID user groups can be used for topology-based troubleshooting and end-to-end access request automation. Currently supported for Panorama and Strata Cloud Manager.

Benefits

• Improved user identity-based topology troubleshooting

• Shorter SLA times for access requests using Entra ID groups

• Fewer manual changes, reducing errors

See Configuring User Identity - EntraID.

Dynamic routes are incorporated into the topology map alongside static routes, enabling accurate end-to-end path analysis, troubleshooting, and automated change target selection in SCM NGFW environments that use dynamic routing protocols.

Benefits:

• More accurate network troubleshooting for SCM NGFW environments - reduced MTTR

• No more manual topology reconciliation efforts - time saving

• Streamlined change automation accuracy - improved SLA

TOS now supports the RFC-5424 syslog format for NSX devices, ensuring traffic hit logs are correctly parsed and revisions are accurately tracked.

Benefits

• Reduced attack surface

• Accurate policy cleanups

• Increased security

The topology map now retrieves shared gateway interfaces and correctly maps them to their policy zones as defined on the Palo Alto device. This ensures accurate network map, correct firewall target selection in Designer, and full policy evaluation for Shared GW-connected network segments.

Benefits

• More accurate topology for Palo Alto Shared GW environments

• No more false positives in path analysis

• Improved change automation accuracy and SLA

• Reduced manual effort

When calculating USP violations, rules which include User Identity (and no subnet specification), are now validated against a dedicated, pre-defined User Network Zone.

Benefits:

• Reduced cost of preparations and readiness for compliance audits for NGFW devices

See Rule Violations - Additional info for NGFW rules.

Access request tickets involving NSX-T DFW can now be submitted with topology mode off, including Verifier, Designer, and Provisioning.

Benefits:

• A more streamline automation process

• Increased operational efficiency

Tufin extends the access request automation workflow to Strata Cloud Manager (SCM) NGFW Folders, operating in topology mode. Verifier checks whether IP-based traffic is already permitted by existing SCM rules. Designer suggests rule creation or modification against the correct SCM folder in the policy hierarchy, respecting snippet visibility (read-only). Provisioning automatically commits approved changes directly to SCM.

Benefits:

• Reduced SLA through fully automated access requests for SCM devices

• Automated change process, reduced errors

• Reduced attack surface

• Saving in time and money

See SecureChange features by vendor - Strata Cloud Manager.

TOS now provides policy visibility and topology support for AWS Network Firewall. Support includes AWS Firewall Policies, their rulesets, and associated firewalls.

Search for rules in Rule Viewer for troubleshooting purposes, identify USP violations for rules that do no comply with internal and industry regulations, and troubleshoot network access in the topology map to see if it is allowed or blocked.

Benefits:

• Continuous compliance

• Reduced MTTR for network issues

• Increased operational efficiency

See SecureTrack features by vendor - AWS Network Firewalls and AWS Network Firewall import.

Analyzes existing zone and subnet data, identifies zone configuration errors, and recommends actionable fixes and next steps.

Benefits:

• Instant visibility into zone and subnet configurations

• Identifying misconfigurations before they become risks

• Time saving - hours of manual review can be avoided

• Clear, actionable fixes ready to implement

View and search for rules in Rule Viewer by the date they were added to TOS, using the timeAdded TQL field.

Benefits:

• Improved rule visibility

• Reduced costs preparing for audit

See TQL fields for Rule Viewer - timeAdded and Rule Viewer Overview.

Search for 3rd party OPM rules in Rule Viewer by vendor name.

Benefits:

• Improved rule visibility - time saving and improved efficiency

Search for rules in Rule Viewer by the network security zone(s) containing their source or destination.

Benefits:

• Improved rule visibility - reduced cost of audit preparation

Tufin extends AWS Cloud WAN support to retrieve and model Network Function Groups (NFGs) and their service insertion configuration in the Topology Map - including the NFGs defined in the core network, the segments and attachments associated with them, and the send-to / send-via actions that steer traffic through inspection VPCs. This lets TOS represent the security appliances inserted into the Cloud WAN path, so path analysis reflects the actual inspection hop and SecureChange identifies the correct enforcement target for access requests that traverse NFGs across AWS regions.

Benefits:

• Faster resolution of connectivity issues

• Safer automation changes

• Reliable representation of inspection and enforcement points in Cloud WAN topology

See AWS Cloud WAN import.

You can now provision approved changes from SecureChange Access Requests directly onto Meraki MX devices, the same way other supported firewall platforms work today. Approved access requests are translated into the correct Meraki construct, depending on rule type — Site-to-Site VPN rules at the organization level, Layer 3 firewall rules at the per-network level, and group policy rules at the per-group-policy level — and pushed to the target MX devices. Implicit IPv4 hosts and subnets are supported as sources and destinations for all three rule types and provisioning is gated by topology being on to make sure each rule lands in the right place.

Benefits:

• Fully automated, consistent, auditable change process

• Reduced manual effort on changes

• Reduced risk of human error

See SecureChange features by vendor - Meraki.

You can now onboard Cisco L3 switches into SecureTrack via the bulk device API, the same way routers and other L3 devices are onboarded today.

Benefits:

• Reduced manual effort and time spent on device management tasks

For path analysis involving NSX devices, the rule-matching logic now considers traffic associated with Security Groups (SGs) specified in the NSX rule's Applied To field.

Benefits:

• Reduced MTTR

• Improved SLA times

See SecureTrack Features by Vendor - VMWare.

Visibility added for two additional NSX Security Group (SG) types:

• Virtual machine name = value criteria.

• Virtual machine tag AND scope membership criteria.

These SGs are now fully supported across Rule Viewer and topology, and can be leveraged by automation workflows, enabling traffic associated with these groups to be accurately analyzed.

Benefits:

• Increased Security

• Reduced attack surface

A new feature flag for Palo Alto Panorama-managed firewalls that retrieves rule last-hit data using the Panorama API instead of syslogs. When enabled, the Rule Viewer’s last hit indication is based on the timestamp returned by the API.

Benefits:

• More accurate cleanup process for PAN rules

• Reduced attack surface

• Reduced manual effort

See Configuring TOS - Collect rule last hit information from Panorama devices.

Extends the existing Check Point object-usage (last-hit) collection and Rule Viewer display to include FQDN/domain-based objects. FQDN objects are now processed by the same object-usage analysis pipeline used for other Check Point objects, so their last-hit data is collected and surfaced consistently in the Rule Viewer. Supported across Check Point CMA, SMC, and Smart-1.

Benefits:

• More accurate cleanup process for Check Point FQDN rules

• Reduced attack surface

• Reduced manual effort

See SecureTrack Features by Vendor - Check Point.

A new API to create, update and retrieve SecureTrack zones.

Benefits:

• Automation of zone maintenance and reporting

• Reduced time and costs of audit preparation

Vertical and horizontal scroll bars appear when needed in the USP Viewer.

Benefits:

• Improved user experience

SecureChange admins can define for each user whether they can generate reports on all tickets or only their own.

Benefits:

• Improved control over access

• Implementation of least-privilege security

With this API, you can enable or disable specific Check Point module gateways that have been decommissioned or are standby / test devices, from license counting. You only pay for the devices that deliver value; disabled devices do not consume a license but remain visible in TOS.

Benefits:

• Reduced TOS licensing costs

TOS now supports IPv6 interfaces and routing (static and dynamic) for Palo Alto Networks devices managed by Panorama, across both advanced routing and legacy routing modes. IPv6 traffic is included in topology mapping, path analysis, and rule matching. In addition, SecureChange access requests now support IPv6 for automatic target selection on PAN devices.

Benefits:

• Improved troubleshooting for IPv6 connectivity.

• Improved overall automation accuracy.

See Examples of NAT rules.

As part of 'Commit Now' and 'Change Window' in SecureChange, TOS performs two actions in Panorama: 'Commit to Panorama' (can be scoped to Tufin user changes) and 'Push to Devices' (previously always pushed all user changes). The new enhancement lets you configure the 'Push to Devices' scope — either all Panorama users or Tufin user changes only.

Benefits:

• Reduced risk by ensuring only approved, Tufin-managed changes are pushed.

• True zero-touch automation — controlled committing and pushing without manual intervention

• Reduced operational overhead by eliminating the need to manually manage Panorama commits and pushes

See Provisioning Panorama by user and configuration type.

You can now configure TOS to push only device group policy changes to Panorama-managed firewalls, without pushing Panorama templates.

Benefits:

• Prevention of unintended template deployments during SecureChange provisioning.

• Reduced risk of operational errors and application downtime by ensuring only approved, TOS-managed changes are pushed.

• Zero-touch automation and reduced change SLA by enabling TOS to commit and push without manual intervention.

See Provisioning Panorama by user and configuration type.

TOS topology now includes microsegmentation devices in path analysis. When source/destination is a managed asset, TOS detects and shows the microsegmentation device on the path with its matching rules (including tag-based, tag group, and alert rules). Supports same-subnet and behind-cloud scenarios. You can select Guardicore/Illumio assets as path query endpoints.

Benefits:

• Reduced MTTR when microsegmentation is part of the path.

• Fewer manual investigation steps means less engineering time spent per incident.

• End-to-end path analysis across firewalls, cloud, SASE, and microsegmentation is available in one unified view, so teams identify the blocking rule, whether a firewall or a Guardicore/Illumio tag-based rule.

Designer now suggests updating and creating groups as needed on Zscaler ZIA instead of raw embedded IP addresses or services,

Benefits:

• Cleaner, more maintainable firewall change suggestions for these OPM-managed devices.

• Improved policy readabilty and maintinability

You can now get deep, tag-aware visibility into Guardicore policies in the Rule Viewer- including resolving tags to assets, filtering rules by asset tags, IPs or names, and tracking rule history changes triggered by asset tag updates.

Benefits:

• Full transparency into which assets tag-based rules cover.

• Faster, more accurate policy analysis and auditing.

• Meaningful change tracking without noise.

• Accurate permissiveness scoring.

• Identification and clean up unused Guardicore rules using last hit data which reduces the attack surface and risk. Enterprise-scale support (300K assets).

You can now detect USP violations, view topology run path analysis for Strata Cloud Manager NGFW policies.

Benefits:

• Improved operational efficiency

• Time saving in troubleshooting and audit preparation

• Reduced MTTR

• Improved security

• Continous compliance.

VeloCloud SD-WAN devices can now be monitored by TOS, bringing them into the unified control plane used to manage and monitor firewalls, routers, cloud resources, and hybrid environments. Security and traffic policies from VeloCloud are visible, validated, and governed like all other network devices.

Benefits:

• Consistent security policies across the entire hybrid architecture.

• Faster, safer change implementation.

• Stronger compliance posture and audit readiness.

• Reduced operational complexity and misconfiguration risk.

• Improved incident response through unified path visibility.

See SecureTrack features and SecureChange features for Arista VeloCloud.

TOS administrators can now to craft their own dashboards and define charts to present unique and customized aggregations over security rules and SecureChange tickets. Based on specifications given in natural language, AI-generated code fetches filtered data from TOS and renders it into charts and reports.

Benefits:

• Generate your own dashboards and reports

• Examples: Daily monitoring, proof of ROI, compliance audit preparation, policy cleanup planning, ticket SLA, policy vulnerabilities.

See Personalize TufinAI Executive Dashboard.

FQDN objects are now supported for Cisco FMC including visibility, topology, compliance, and access request automation. Visibility into FQDN content is supported in the Rule Viewer and Compare Revisions. You can run path analysis queries by using FMC FQDN objects and identify allowing/blocking rules. You can automate access requests that include FQDN objects where rules have to be changed / added, including target selection, design, verification and provisioning.

Benefits

• Reduced SLA through fully automated access request handling.

• Improved accuracy

See SecureTrack and SecureChange features for Cisco FMC.

TOS now supports VNet flow logs, and Azure resource specific log analytics collection to provide cleanup and optimization insights for Azure NSGs and firewalls.

Benefits:

• Reduced attack surface

• Improved security posture

• Reduced time spent on manual cleanup/optimization

See Azure configuration for flow logs.

TOS can now be installed on Red Hat Enterprise Linux 9 and Rocky Linux 9 operating systems

Benefits:

• Addresses market demand to install TOS on more recent operating system versions

• Improves security and compliance posture

• Streamlines deployment

See TOS release history.

Amazon's AWS SDK v1 has reached end of support, and will not receive further security or new region updates. Therefore, for all new installations, TOS will monitor AWS using SDK v2. For upgrades, from older installations, TOS will continue using SDK v1.

By the end of the year, SDK v2 will become the default both for clean installs and upgrades from previous versions.

All TOS enhancements for AWS added in TOS 5 and later will require AWS SDK v2.

Therefore, we recommend moving to AWS SDK v2.

Benefits:

• Ensures latest AWS security and other updates

• Access to the latest TOS features for AWS (RDS, prefix lists and opt-in regions)

See Use AWS SDK v2 for AWS monitoring.

AWS RDS instances are now visible in TOS. Security Group policies applied to RDS endpoints can be viewed, searched by IP, and included in topology and path analysis.

TOS retrieves AWS RDS instances and associates their security groups, modeling them as network entities. RDS instances are counted as licensed VM entities.

This feature requires AWS SDK v2.

Benefits:

• Full visibility of policies protecting AWS databases.

• Accurate path analysis to RDS endpoints.

• Improved compliance posture for AWS environments.

See SecureTrack Features by Vendor > Amazon.

TOS now supports monitoring AWS opt-in regions using assume role authorization. TOS can monitor the accounts and resources deployed in the opt-in regions by AWS using assume role authorization. Requires enablement of AWS SDK2. Otherwise, a local user must be used for authentication and authorization.

This feature requires SDK v2.

Benefits:

• Full visibility of policies protecting AWS databases.

• Accurate path analysis for resources deployed in opt-in regions

See SecureTrack Features by Vendor > Amazon.

5.0.00 is the first version of the TOS 5 platform version. It is not for production deployment but rather meant to test and verify that the new TOS infrastructure deploys and runs smoothly in a lab environment. Generally first versions of platform versions contains infrastructure updates and bug fixes, but little or no new features. Subsequent versions starting with 5.1.00 will contain new features.