PAN-OS Policy Optimizer

Automate your AppID Adoption by using this integration together with your Palo Alto Networks Next-Generation Firewall or Panorama.

Network Security · PAN-OS Policy Optimizer (beta)

Details

IDPAN-OS Policy Optimizer
ProviderPalo Alto Networks
CategoryNetwork Security
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Automate your AppID Adoption by using this integration together with your Palo Alto Networks Next-Generation Firewall or Panorama.
This integration was integrated and tested with version 8 up to version 10.1.6 and version 10.2.0 of PAN-OS Policy Optimizer.
Moved to beta due to the lack of a formal API.

Configure PAN-OS Policy Optimizer (Beta) in Cortex

Parameter Required
Server URL (e.g., https://192.168.0.1:443) True
Username True
Password True
Vsys - Firewall instances only False
Device Group - Panorama instances only False
PAN-OS Version (The exact version, e.g., 10.1.4, 1.1, 9) False
Trust any certificate (not secure) False
Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

pan-os-po-get-stats

Gets the Policy Optimizer statistics.

Base Command

pan-os-po-get-stats

Input

Argument Name Description Required
position Whether to get pre-rules statistics or post-rules statistics. ‘pre’ for pre rules, ‘post’ for post-rules. Only for Panorama instances. Possible values are: pre, post. Default is pre. Optional

Context Output

Path Type Description
PanOS.PolicyOptimizer.Stats.no_app_specified Number Number of rules with no apps specified.
PanOS.PolicyOptimizer.Stats.unused Number Number of unused security policies.
PanOS.PolicyOptimizer.Stats.unused_apps Number Number of unused apps in security policies.
PanOS.PolicyOptimizer.Stats.unused_in_30_days Number Number of unused security policies in 30 days.
PanOS.PolicyOptimizer.Stats.unused_in_90_days Number Number of unused security policies in 90 days.

Command Example


#### Context Example

```json
{
    "PanOS": {
        "PolicyOptimizer": {
            "Stats": {
                "no_app_specified": "1",
                "unused": "8",
                "unused_apps": "0",
                "unused_in_30_days": "13",
                "unused_in_90_days": "12"
            }
        }
    }
}

Human Readable Output

Policy Optimizer Statistics

@name text
no_app_specified 1
unused_apps 0
unused_in_30_days 13
unused_in_90_days 12
unused 8

pan-os-po-no-apps

Shows all security policies with no apps specified.

Base Command

pan-os-po-no-apps

Input

Argument Name Description Required
position Whether to get pre-rules with no apps or post-rules with no apps. ‘pre’ for pre rules, ‘post’ for post-rules. Only for Panorama instances. Possible values are: pre, post. Default is pre. Optional

Context Output

Path Type Description
PanOS.PolicyOptimizer.NoApps Unknown Contains information about the rules that have no apps specified. For example, Source and Destination.

Command Example


#### Context Example

```json
{
    "PanOS": {
        "PolicyOptimizer": {
            "NoApps": {
                "@__recordInfo": "{\"permission\":\"readonly\",\"xpathId\":\"panorama\",\"vsysName\":\"vsys1\",\"position\":\"pre\"}",
                "@loc": "Lab-Devices",
                "@name": "pano_rule",
                "@panorama": "true",
                "@uuid": "uuid",
                "action": "allow",
                "application": {
                    "member": [
                        "any"
                    ]
                },
                "apps-allowed-count": "0",
                "apps-seen-count": "72",
                "bytes": "84800223916",
                "category": {
                    "member": [
                        "any"
                    ]
                },
                "days-no-new-app-count": "193",
                "description": "a test rule for the move function",
                "destination": {
                    "member": [
                        "any"
                    ]
                },
                "first-hit-timestamp": "1602403843",
                "from": {
                    "member": [
                        "any"
                    ]
                },
                "hip-profiles": {
                    "member": [
                        "any"
                    ]
                },
                "hit-count": "32193134",
                "last-app-seen-since-count": "193",
                "last-hit-timestamp": "1602468975",
                "last-reset-timestamp": "0",
                "rule-creation-timestamp": "1575916248",
                "rule-modification-timestamp": "1614045009",
                "service": {
                    "member": [
                        "application-default"
                    ]
                },
                "source": {
                    "member": [
                        "any"
                    ]
                },
                "source-user": {
                    "member": [
                        "any"
                    ]
                },
                "to": {
                    "member": [
                        "any"
                    ]
                }
            }
        }
    }
}

Human Readable Output

Policy Optimizer No App Specified

@name @uuid action description source destination
pano_rule uuid allow a test rule for the move function member: any member: any

pan-os-po-unused-apps

Gets the unused apps.

Base Command

pan-os-po-unused-apps

Input

Argument Name Description Required
position Whether to get pre-rules unused apps or post-rules unused apps. ‘pre’ for pre rules, ‘post’ for post-rules. Only for Panorama instances. Possible values are: pre, post. Default is pre. Optional

Context Output

Path Type Description
PanOS.PolicyOptimizer.UnusedApps String Shows all security rules with unused apps.

pan-os-po-get-rules

Gets unused, used, or any rules.

Base Command

pan-os-po-get-rules

Input

Argument Name Description Required
timeframe The time frame in days to show the unused rules. Default is 30. Optional
usage Rule usage type to filter by. Can be Unused, Used, or Any. Possible values are: Unused, Used, Any. Default is Unused. Optional
exclude Whether to exclude rules reset during the last x days, where x is the value defined in the timeframe argument. It will not exclude rules by default. Possible values are: false, true. Default is false. Optional
position Whether to get pre-rules, post-rules or both. ‘pre’ for pre rules, ‘post’ for post-rules, only for panorama instances. Possible values are: pre, post, both. Default is both. Optional
rule_type Which type of rules to query. Possible values are: security, nat, qos, pbf, decryption, tunnel-inspect, application-override, authentication, dos, sdwan. Default is security. Optional
limit The maximum number of rules to return. Default is 200. Optional
page_size The amount of items to return in each paginated call. Can only be a value of up to 200. Default is 200. Optional
page A specific pagination page to get items from. Optional

Context Output

Path Type Description
PanOS.PolicyOptimizer.UnusedRules String Shows all unused security rules.
PanOS.PolicyOptimizer.AnyRules String Shows all security rules.
PanOS.PolicyOptimizer.UsedRules String Shows all used security rules.

Command Example

!pan-os-po-get-rules usage=Any

Context Example

{
    "PanOS": {
        "PolicyOptimizer": {
            "AnyRules": [
                {
                    "@__recordInfo": "{\"permission\":\"readonly\",\"xpathId\":\"panorama\",\"vsysName\":\"vsys1\",\"position\":\"pre\"}",
                    "@loc": "Lab-Devices",
                    "@name": "tip rule",
                    "@panorama": "true",
                    "@uuid": "uuid",
                    "action": "allow",
                    "application": {
                        "member": [
                            "any"
                        ]
                    },
                    "apps-allowed-count": "0",
                    "apps-seen-count": "0",
                    "bytes": "0",
                    "category": {
                        "member": [
                            "any"
                        ]
                    },
                    "days-no-new-app-count": [],
                    "destination": {
                        "member": [
                            "any"
                        ]
                    },
                    "first-hit-timestamp": "0",
                    "from": {
                        "member": [
                            "any"
                        ]
                    },
                    "hip-profiles": {
                        "member": [
                            "any"
                        ]
                    },
                    "hit-count": "0",
                    "last-app-seen-since-count": [],
                    "last-hit-timestamp": "0",
                    "last-reset-timestamp": "0",
                    "rule-creation-timestamp": "1575925916",
                    "rule-modification-timestamp": "1614045009",
                    "service": {
                        "member": [
                            "application-default"
                        ]
                    },
                    "source": {
                        "member": [
                            "tip"
                        ]
                    },
                    "source-user": {
                        "member": [
                            "any"
                        ]
                    },
                    "to": {
                        "member": [
                            "any"
                        ]
                    }
                }
            ]
        }
    }
}

Human Readable Output

PolicyOptimizer AnyRules

@name @uuid action description source destination
tip rule uuid allow   member: tip member: any

pan-os-po-app-and-usage

Gets the app usage statistics for a specific security rule.

Base Command

pan-os-po-app-and-usage

Input

Argument Name Description Required
rule_uuid The UUID of the security rule. Required

Context Output

Path Type Description
PanOS.PolicyOptimizer.AppsAndUsage Unknown Shows detailed app usage statistics for specific security rules.

Command Example

!pan-os-po-app-and-usage rule_uuid=uuid

Human Readable Output

Rule with UUID:{uuid} does not use apps.

pan-os-get-dag

Gets a specific dynamic address group.

Base Command

pan-os-get-dag

Input

Argument Name Description Required
dag Dynamic address group name. Required

Context Output

There is no context output for this command.

Configuration parameters

  • server_url — Server URL (e.g., https://192.168.0.1:443) (required)
  • credentials — Username (required)
  • vsys — Vsys - Firewall instances only
  • device_group — Device Group - Panorama instances only
  • version — PAN-OS Version (The exact version, e.g., 10.1.4, 1.1, 9)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (6)

  • pan-os-get-dag

    Gets a specific dynamic address group.

  • pan-os-po-app-and-usage

    Gets the app usage statistics for a specific security rule.

  • pan-os-po-get-rules

    Gets unused, used, or any rules.

  • pan-os-po-get-stats

    Gets the Policy Optimizer statistics.

  • pan-os-po-no-apps

    Shows all security policies with no apps specified.

  • pan-os-po-unused-apps

    Gets the unused apps.

Source

PANOSPolicyOptimizer.py PANOSPolicyOptimizer_test.py PANOSPolicyOptimizer.yml PANOSPolicyOptimizer_description.md command_examples.txt
Download History Raw 
category: Network Security
provider: Palo Alto Networks
commonfields:
  id: PAN-OS Policy Optimizer
  version: -1
configuration:
- display: Server URL (e.g., https://192.168.0.1:443)
  name: server_url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- display: Vsys - Firewall instances only
  name: vsys
  type: 0
  required: false
- display: Device Group - Panorama instances only
  name: device_group
  type: 0
  required: false
- defaultvalue: '8'
  display: PAN-OS Version (The exact version, e.g., 10.1.4, 1.1, 9)
  name: version
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Automate your AppID Adoption by using this integration together with your Palo Alto Networks Next-Generation Firewall or Panorama.
display: PAN-OS Policy Optimizer (Beta)
name: PAN-OS Policy Optimizer
script:
  commands:
  - description: Gets the Policy Optimizer statistics.
    name: pan-os-po-get-stats
    arguments:
    - auto: PREDEFINED
      description: Whether to get pre-rules statistics or post-rules statistics. 'pre' for pre rules, 'post' for post-rules. Only for Panorama instances.
      name: position
      defaultValue: 'pre'
      predefined:
      - pre
      - post
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    outputs:
    - contextPath: PanOS.PolicyOptimizer.Stats.no_app_specified
      description: Number of rules with no apps specified.
      type: Number
    - contextPath: PanOS.PolicyOptimizer.Stats.unused
      description: Number of unused security policies.
      type: Number
    - contextPath: PanOS.PolicyOptimizer.Stats.unused_apps
      description: Number of unused apps in security policies.
      type: Number
    - contextPath: PanOS.PolicyOptimizer.Stats.unused_in_30_days
      description: Number of unused security policies in 30 days.
      type: Number
    - contextPath: PanOS.PolicyOptimizer.Stats.unused_in_90_days
      description: Number of unused security policies in 90 days.
      type: Number
  - description: Shows all security policies with no apps specified.
    name: pan-os-po-no-apps
    arguments:
    - auto: PREDEFINED
      description: Whether to get pre-rules with no apps or post-rules with no apps. 'pre' for pre rules, 'post' for post-rules. Only for Panorama instances.
      name: position
      defaultValue: 'pre'
      predefined:
      - pre
      - post
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    outputs:
    - contextPath: PanOS.PolicyOptimizer.NoApps
      description: Contains information about the rules that have no apps specified. For example, Source and Destination.
      type: Unknown
  - description: Gets the unused apps.
    name: pan-os-po-unused-apps
    arguments:
    - auto: PREDEFINED
      description: Whether to get pre-rules unused apps or post-rules unused apps. 'pre' for pre rules, 'post' for post-rules. Only for Panorama instances.
      name: position
      defaultValue: 'pre'
      predefined:
      - pre
      - post
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    outputs:
    - contextPath: PanOS.PolicyOptimizer.UnusedApps
      description: Shows all security rules with unused apps.
      type: String
  - arguments:
    - defaultValue: '30'
      description: The time frame in days to show the unused rules.
      name: timeframe
    - auto: PREDEFINED
      defaultValue: Unused
      description: Rule usage type to filter by. Can be Unused, Used, or Any.
      name: usage
      predefined:
      - Unused
      - Used
      - Any
    - defaultValue: 'false'
      description: Whether to exclude rules reset during the last x days, where x is the value defined in the timeframe argument. It will not exclude rules by default.
      name: exclude
      predefined:
      - 'false'
      - 'true'
      auto: PREDEFINED
    - auto: PREDEFINED
      description: Whether to get pre-rules, post-rules or both. 'pre' for pre rules, 'post' for post-rules, only for panorama instances.
      name: position
      defaultValue: 'both'
      predefined:
      - pre
      - post
      - both
    - defaultValue: security
      description: Which type of rules to query.
      name: rule_type
      predefined:
      - security
      - nat
      - qos
      - pbf
      - decryption
      - tunnel-inspect
      - application-override
      - authentication
      - dos
      - sdwan
      auto: PREDEFINED
    - defaultValue: '200'
      description: The maximum number of rules to return.
      name: limit
    - defaultValue: '200'
      description: The amount of items to return in each paginated call. Can only be a value of up to 200.
      name: page_size
    - description: A specific pagination page to get items from.
      name: page
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    description: Gets unused, used, or any rules.
    name: pan-os-po-get-rules
    outputs:
    - contextPath: PanOS.PolicyOptimizer.UnusedRules
      description: Shows all unused security rules.
      type: String
    - contextPath: PanOS.PolicyOptimizer.AnyRules
      description: Shows all security rules.
      type: String
    - contextPath: PanOS.PolicyOptimizer.UsedRules
      description: Shows all used security rules.
      type: String
  - arguments:
    - description: The UUID of the security rule.
      name: rule_uuid
      required: true
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    description: Gets the app usage statistics for a specific security rule.
    name: pan-os-po-app-and-usage
    outputs:
    - contextPath: PanOS.PolicyOptimizer.AppsAndUsage
      description: Shows detailed app usage statistics for specific security rules.
      type: Unknown
  - arguments:
    - description: Dynamic address group name.
      name: dag
      required: true
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    description: Gets a specific dynamic address group.
    name: pan-os-get-dag
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: ''
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 6.0.0
beta: true