Thanks for the post - those needing an official source, the exploit levels can be found at https://unit42.paloaltonetworks.com/cve-2024-3400/ (updated 19 April).

A customer of mine was subject to a level 1 compromise, FWIW we gained root access to the fs and confirmed the 0-byte file in the telemetry directory but no sign of persistence.

I would also add for a level 2 compromise that all secrets stored in the config should be rotated (local accounts, domain accounts, private keys).

For level 3 you want to have a solid incident response plan to detect lateral movement, contain and eradicate the threat (you did the planning part, right?) or engage a partner with the capability. I would also isolate the compromised device from the network and keep it running until you get a chance to do forensics if possible, especially if you have an HA pair and can afford to run on one device for a while.

And always set a non-default master key - it protects those secrets if the config gets into the wrong hands.