Palo Alto Networks Automatic SLR (Community)

Details

ID	`Palo Alto Networks Automatic SLR (Community)`
Provider	Open Source
Category	Utilities
From Version	5.0.0
Docker Image	`demisto/xml-feed:1.0.0.10133006`
Supported Modules	Agentix XSIAM

README

Use the Palo Alto Networks NGFW API to automatically generate a Security Lifecycle Review (SLR) Report.

Configure Automatic SLR on XSOAR

Navigate to Settings > Integrations > Utilities.
Search for “Palo Alto Networks Automatic SLR.

Click Add instance to create and configure a new integration instance.

Parameter	Description
Name	A meaningful name for the integration instance.
Firewall FQDN/IP	Management FQDN or IP address of the firewall
Firewall TCP Port	Management Port (Default: `443`) of the firewall
Firewall API Key	API Key for the target firewall
Firewall Timeout	Timeout value in seconds for API operations (Default: `300`)
Verify Firewall Certificate	Verify the SSL/TLS Certificate the firewall presents
CSP API Key	The API Key for the Palo Alto Networks Customer Support Portal (CSP)
CSP Timeout	Timeout value in seconds for API operations (Default: `300`)
Verify CSP Certificate	Verify the SSL/TLS Certificate for the CSP
XSOAR System Proxy	Enable if XSOAR utilises a proxy
Enable Verbose Output	Enables debug/verbose output to the war room
Customer Account Name	Name of organisation to appear on the SLR Report
Firewall Deployment Location	Select the logicial deployment location of the firewall
Deployment Country	Set the country the customer/firewall resides in
Deployment Geographic Region	Select the geographic region the customer/firewall resides in
Customer Industry	Select the industry the customer is in
Language	Select the language for the report to be generated in
Prepared By	Set the name of the person who generated the report
Requested By	Set the email address of the person who generated the report
Send To	Set the email address of the receipient who will receive the report

Click Test to validate integration can communicate with the firewall.

NOTE: The test command does not function when Enable Verbose Output is set to enabled/true.

Step-by-step configuration

This section will cover how to retrieve the Palo Alto Networks Customer Support Portal (CSP) and PAN-OS API key’s

Firewall API Key

A firewall “Super User” or administrator with a custom “Admin Role” limiting their interaction with the API is required to complete these steps.

This integration requires an API Key for the target firewall in order to run the neccesary API commands.
In order to retireve that API Key either:

Run this command from a terminal, replacing <firewall>, <username> and <password> as needed -

curl -k -X GET 'https://<firewall>/api/?type=keygen&user=<username>&password=<password>'

Or

curl -k -X POST 'https://<firewall>/api/?type=keygen&user=<username>&password=<password>'

Alternatively, open a browser window and navigate to: https://<firewall>/api/?type=keygen&user=<username>&password=<password>

<response status="success"> 
    <result> 
        <key>gJlQWE56987nBxIqyfa62sZeRtYuIo2BgzEA9UOnlZBhU</key> 
    </result> 
</response>

Reference Material

How-to generate an API Key: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/get-your-api-key.html

Customer Support Portal (CSP) API Key

A Customer Support Portal “Super User” is required to complete these steps.

Ensure you have the “Super User” role assigned to your account by logging in to the CSP, then navigating to: Support Home > Members > Manage Users
Under the “Roles” column you should have “Super User” assigned.
Once you have the correct role assigned to your user, navigate to: Support Home > Assets > Licensing API
If a key already exists, it will be displayed to you. We will use this key in the integration configuration.
If a key does exist, click Generate to generate a new API key

NOTE: Pay attention to the expiry date and extend/regenerate the key as neccesary.

Reference Material

Customer Support Portal Roles: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaTCAS
How-to Generate the API Key: https://docs.paloaltonetworks.com/vm-series/10-0/vm-series-deployment/license-the-vm-series-firewall/licensing-api/manage-the-licensing-api-key.html

Commands

You can execute these commands from the Cortex XSOAR CLI or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Dump Integration Parameters

In some circumstances, it may be required to get visbility of all currently configured parameters dumped to the context for troubleshooting.

Base Command

!autoslr-dump-params

Arguments

There are no input arguments for this command.

Context Output

Context Key	Description	Type
AutoSLR.params.csp_host	The CSP base URL	String
AutoSLR.params.csp_proxy	Enable/disable system proxy for CSP communications	Boolean
AutoSLR.params.csp_timeout	The timeout value for CSP API operations	Integer
AutoSLR.params.csp_tls_verify	Enable/disable TLS verification for the CSP	Boolean
AutoSLR.params.csp_verbose	Enable/disable verbose output for CSP operations	Boolean
AutoSLR.params.ngfw_host	The firewall base URL	String
AutoSLR.params.ngfw_port	The firewall TCP port	Integer
AutoSLR.params.ngfw_proxy	Enable/disable system proxy for NGFW communications	Boolean
AutoSLR.params.ngfw_timeout	The timeout value for NGFW API operations	Integer
AutoSLR.params.ngfw_tls_verify	Enable/disable TLS verification for the CSP	Boolean
AutoSLR.params.ngfw_verbose	Enable/disable verbose output for CSP operations	Boolean
AutoSLR.params.slr_account_name	The account name to appear on the SLR report	String
AutoSLR.params.slr_country	The deployment country of the firewall	String
AutoSLR.params.slr_deployment_location	The logical deployment location of the firewall	String
AutoSLR.params.slr_geographic_region	The geographic region the firewall is deployed in	String
AutoSLR.params.slr_industry	The industry of the customer organisation	String
AutoSLR.params.slr_language	The language the report should be generated in	String
AutoSLR.params.slr_prepared_by	The name of the person who generated the report	String
AutoSLR.params.slr_requested_by	The email address of the person who generated the report	String
AutoSLR.params.slr_send_to	The email address of the receipient of the report	String
AutoSLR.params.system_proxy	Global enable/disable the use of the system proxy	String
AutoSLR.params.system_verbose	Global enable/disable the verbose/debugging output	String

Retrieve “show system info” Output

This command will retrieve certain information about the target firewall for use within other functions.

Base Command

!autoslr-ngfw-system-info

Arguments

There are no input arguments for this command.

Context Output

Context Key	Description	Type
AutoSLR.ngfw_system_info.hostname	The hostname of the target firewall	String
AutoSLR.ngfw_system_info.serial	The serial number of the target firewall	String
AutoSLR.ngfw_system_info.software	The PAN-OS software version of the target firewall	String

Initiate SLR Generation

This command will initiate the *-stats_dump.tar.gz generation job on the target firewall

Base Command

!autoslr-ngfw-generate

Arguments

There are no input arguments for this command.

Context Output

Context Key	Description	Type
AutoSLR.generate.job_id	The Job ID of the generation task	Integer

Check SLR Generation Status

This command will check the *-stats_dump.tar.gz generation job on the target firewall

Base Command

!autoslr-ngfw-check

Arguments

Argument	Description	Type
job_id	The Job ID of the generation task	Integer

Context Output

Context Key	Description	Type
AutoSLR.generate.job_status	The Job status of the generation task	Boolean

Download *-stats_dump.tar.gz from the firewall

This command will download the *-stats_dump.tar.gz from the target firewall

Base Command

!autoslr-ngfw-download

Arguments

Argument	Description	Type
job_id	The Job ID of the generation task	Integer

Context Output

Context Key	Description	Type
AutoSLR.generate.file_name	The human readable filename of the downloaded file	String
InfoFile.EntryID	The EntryID of the downloaded file	String

Note: In the default playbook supplied with the content pack, InfoFile.EntryID is copied to AutoSLR.generate.EntryID for use in the upload function.

Upload *-stats_dump.tar.gz to Palo Alto Networks

This command will upload the *-stats_dump.tar.gz file to Palo Alto Networks for report generation

Base Command

!autoslr-csp-upload

Arguments

Argument	Description	Type
input_file	The EntryID of the file to upload	String

Context Output

Context Key	Description	Type
AutoSLR.upload.id	The SLR Reference ID returned by the CSP API	String
AutoSLR.upload.send_to	The email address the completed report will be sent to	String

Configuration parameters

ngfw_fqdn_ip — Firewall Management FQDN or IP Address (required)
ngfw_port — Firewall Management TCP Port (required)
ngfw_api_key — Firewall Management API Key (required)
ngfw_timeout — Firewall Timeout (required)
ngfw_tls_verify — Verify Firewall TLS Certificate
csp_api_key — Customer Support Portal (CSP) API Key (required)
csp_timeout — CSP Timeout (required)
csp_tls_verify — Verify CSP TLS Certificate
system_proxy — XSOAR System Proxy
system_debug — Enable Verbose Output
slr_account_name — Customer Account Name (required)
slr_deployment_location — Firewall Deployment Location (required)
slr_geographic_country — Deployment Country (required)
slr_geographic_region — Deployment Geographic Region (required)
slr_industry — Customer Industry (required)
slr_language — Language (required)
slr_prepared_by — Prepared By (required)
slr_requested_by — Requested By (required)
slr_send_to — Send To (required)

Commands (6)

autoslr-csp-upload
Uploads the stats_dump.tar.gz to Palo Alto Networks.
autoslr-dump-params
This command will dump all the non-sensitive parameters to the context, useful for debugging purposes.
autoslr-ngfw-check
Checks the status of the stats_dump.tar.gz generation job, returns true when completed.
autoslr-ngfw-download
Downloads the stats_dump.tar.gz from the target firewall.
autoslr-ngfw-generate
Initiates the stats_dump.tar.gz generation job on the target firewall.
autoslr-ngfw-system-info
Retrieve information about the target firewall.

Source

PaloAltoNetworksAutomaticSLRCommunity.py PaloAltoNetworksAutomaticSLRCommunity.yml PaloAltoNetworksAutomaticSLRCommunity_description.md

Download History Raw

commonfields:
  id: Palo Alto Networks Automatic SLR (Community)
  version: -1
name: Palo Alto Networks Automatic SLR (Community)
display: Palo Alto Networks Automatic SLR
category: Utilities
provider: Open Source
description: Allow XSOAR to automatically generate Security Lifecycle Review's (SLR's).
configuration:
- display: Firewall Management FQDN or IP Address
  name: ngfw_fqdn_ip
  defaultvalue: my-firewall.example.tld
  type: 0
  required: true
  additionalinfo: Do not include http:// or https:// or any trailing slash (/) on the end
- display: Firewall Management TCP Port
  name: ngfw_port
  defaultvalue: "443"
  type: 0
  required: true
- display: Firewall Management API Key
  name: ngfw_api_key
  defaultvalue: default-ngfw-api-key
  type: 4
  required: true
- display: Firewall Timeout
  name: ngfw_timeout
  defaultvalue: "300"
  type: 0
  required: true
  additionalinfo: Timeout (in seconds) to perform firewall API operations
- display: Verify Firewall TLS Certificate
  name: ngfw_tls_verify
  defaultvalue: "true"
  type: 8
  required: false
- display: Customer Support Portal (CSP) API Key
  name: csp_api_key
  defaultvalue: default-csp-api-key
  type: 4
  required: true
  additionalinfo: 'How-to: https://docs.paloaltonetworks.com/vm-series/10-0/vm-series-deployment/license-the-vm-series-firewall/licensing-api/manage-the-licensing-api-key.html'
- display: CSP Timeout
  name: csp_timeout
  defaultvalue: "300"
  type: 0
  required: true
  additionalinfo: Timeout (in seconds) to perform Palo Alto Networks Customer
- display: Verify CSP TLS Certificate
  name: csp_tls_verify
  defaultvalue: "true"
  type: 8
  additionalinfo: Verify Palo Alto Networks Customer Support Portal (CSP) TLS Certificate
  required: false
- display: XSOAR System Proxy
  name: system_proxy
  defaultvalue: "false"
  type: 8
  additionalinfo: Use the configured system proxy for XSOAR to route requests
  required: false
- display: Enable Verbose Output
  name: system_debug
  defaultvalue: "false"
  type: 8
  additionalinfo: Enable Verbose (Debug) Output - Do NOT enable unless needed!
  required: false
- display: Customer Account Name
  name: slr_account_name
  defaultvalue: ACME Inc
  type: 0
  required: true
  additionalinfo: Customer Account Name to appear on the report
- display: Firewall Deployment Location
  name: slr_deployment_location
  defaultvalue: Perimeter/Internet Gateway
  type: 15
  required: true
  options:
  - Datacenter/Internal Segmentation
  - Hybrid (Perimeter and Datacenter)
  - Perimeter/Internet Gateway
- display: Deployment Country
  name: slr_geographic_country
  defaultvalue: United States
  type: 0
  required: true
- display: Deployment Geographic Region
  name: slr_geographic_region
  defaultvalue: Americas
  type: 15
  required: true
  options:
  - Americas
  - APAC
  - EMEA
  - Japan
- display: Customer Industry
  name: slr_industry
  defaultvalue: High Technology
  type: 15
  required: true
  options:
  - Aerospace & Defense
  - Agriculture
  - Automotive
  - Construction
  - Energy
  - Financial Services
  - Government - County
  - Government - Federal
  - Government - International
  - Government - Municipal
  - Government - State
  - Healthcare
  - Higher Education
  - High Technology
  - Hospitality
  - Insurance
  - Lower Education
  - Manufacturing
  - Media & Entertainment
  - Mining
  - Non-Profit
  - Other
  - Pharma & Life Sciences
  - Professional & Legal Services
  - Real Estate
  - Service Provider
  - Telecommunications
  - Transportation & Logistics
  - Utilities
  - Waste Management
  - Wholesale & Retail
  additionalinfo: Tailors certain portions of the output to the relevant industry chosen
- display: Language
  name: slr_language
  defaultvalue: English
  type: 15
  required: true
  options:
  - Chinese (s)
  - Chinese (t)
  - English
  - French
  - German
  - Italian
  - Japanese
  - Korean
  - Polish
  - Portugese
  - Russian
  - Spanish
  - Spanish (Latino)
- display: Prepared By
  name: slr_prepared_by
  defaultvalue: XSOAR Integration
  type: 0
  required: true
  additionalinfo: Name to appear on the front page of the report (e.g. Jane Doe)
- display: Requested By
  name: slr_requested_by
  defaultvalue: xsoar@example.tld
  type: 0
  required: true
  additionalinfo: Email address to appear on the front page of the report (e.g. jane.doe@example.tld)
- display: Send To
  name: slr_send_to
  defaultvalue: customer@example.tld
  type: 0
  required: true
  additionalinfo: Email address to send the report to
script:
  script: ''
  type: python
  commands:
  - name: autoslr-ngfw-generate
    arguments: []
    outputs:
    - contextPath: AutoSLR.generate.job_id
      description: Job ID of stats_dump.tar.gz generation job.
      type: string
    description: Initiates the stats_dump.tar.gz generation job on the target firewall.
  - name: autoslr-ngfw-check
    arguments:
    - name: job_id
      required: true
      description: Job ID to check.
    outputs:
    - contextPath: AutoSLR.generate.job_status
      description: Returns true when completed, false is an error occured.
      type: boolean
    description: Checks the status of the stats_dump.tar.gz generation job, returns true when completed.
  - name: autoslr-ngfw-download
    arguments:
    - name: job_id
      required: true
      description: Job ID of stats_dump.tar.gz generation task.
    outputs:
    - contextPath: AutoSLR.generate.file_name
      description: Filename of downloaded file.
      type: string
    - contextPath: InfoFile.EntryID
      description: EntryID of Downloaded File.
      type: string
    description: Downloads the stats_dump.tar.gz from the target firewall.
  - name: autoslr-csp-upload
    arguments:
    - name: input_file
      description: EntryID of the file to upload.
    outputs:
    - contextPath: AutoSLR.upload.id
      description: SLR Reference ID.
      type: string
    - contextPath: AutoSLR.upload.send_to
      description: Email address where the report is being sent to.
      type: string
    description: Uploads the stats_dump.tar.gz to Palo Alto Networks.
  - name: autoslr-ngfw-system-info
    arguments: []
    outputs:
    - contextPath: AutoSLR.ngfw_system_info.hostname
      description: Firewall Hostname.
      type: string
    - contextPath: AutoSLR.ngfw_system_info.serial
      description: Firewall Serial Number.
      type: string
    - contextPath: AutoSLR.ngfw_system_info.software
      description: Firewall PANOS Version.
      type: string
    description: Retrieve information about the target firewall.
  - name: autoslr-dump-params
    arguments: []
    outputs:
    - contextPath: AutoSLR.params.csp_host
      description: CSP URL.
      type: string
    - contextPath: AutoSLR.params.csp_proxy
      description: Use XSOAR Proxy.
      type: boolean
    - contextPath: AutoSLR.params.csp_timeout
      description: Timeout for API Operation.
      type: number
    - contextPath: AutoSLR.params.csp_tls_verify
      description: Enable/Disable TLS Certificate Verification.
      type: boolean
    - contextPath: AutoSLR.params.csp_verbose
      description: Enable/Disable Verbose Log Output.
      type: boolean
    - contextPath: AutoSLR.params.ngfw_host
      description: Firewall Management FQDN/IP Address.
      type: string
    - contextPath: AutoSLR.params.ngfw_port
      description: Firewall Management TCP Port.
      type: number
    - contextPath: AutoSLR.params.ngfw_proxy
      description: Use XSOAR Proxy.
      type: boolean
    - contextPath: AutoSLR.params.ngfw_timeout
      description: Timeout for API Operation.
      type: number
    - contextPath: AutoSLR.params.ngfw_tls_verify
      description: Enable/Disable TLS Certificate Verification.
      type: boolean
    - contextPath: AutoSLR.params.ngfw_verbose
      description: Enable/Disable Verbose Log Output.
      type: boolean
    - contextPath: AutoSLR.params.slr_account_name
      description: Customer Name.
      type: string
    - contextPath: AutoSLR.params.slr_country
      description: Customer Deployment Country.
      type: string
    - contextPath: AutoSLR.params.slr_deployment_location
      description: Customer Deployment Logical Location.
      type: string
    - contextPath: AutoSLR.params.slr_geographic_region
      description: Customer Deployment Geographic Region.
      type: string
    - contextPath: AutoSLR.params.slr_industry
      description: Customer Industry.
      type: string
    - contextPath: AutoSLR.params.slr_language
      description: 'Customer Langugage.'
      type: string
    - contextPath: AutoSLR.params.slr_prepared_by
      description: Person who generated the report (name).
      type: string
    - contextPath: AutoSLR.params.slr_requested_by
      description: Person who generated the report (email).
      type: string
    - contextPath: AutoSLR.params.slr_send_to
      description: Email address to send the completed report to.
      type: string
    - contextPath: AutoSLR.params.system_proxy
      description: Use XSOAR Proxy.
      type: boolean
    - contextPath: AutoSLR.params.system_verbose
      description: Enable/Disable Verbose Log Output.
      type: boolean
    description: This command will dump all the non-sensitive parameters to the context, useful for debugging purposes.
    execution: true
  dockerimage: demisto/xml-feed:1.0.0.10133006
  subtype: python3
fromversion: 5.0.0
tests:
- No tests (auto formatted)