Panorama

Runs any command supported in the API.

Add an exception to a Vulnerability Protection profile or Anti Spyware profile.

Adds a static route.

Enables assigning EDL to the anti-spyware profile under "DNS Signature Policies".

Applies a security profile to specific rules or rules with a specific tag.

Sets a vulnerability signature to block mode.

Checks for the latest available dynamic update versions and returns a list of latest available / currently installed content. When running from a Panorama instance, the 'target' argument must be specified.

Checks the PAN-OS software version from the repository.

Checks the status of a logs query.

Deprecated. Use the pan-os-check-logs-status command instead.

Commits a configuration to the Palo Alto firewall or Panorama, validates if a commit was successful if using polling="true" otherwise does not validate if the commit was successful. Committing to Panorama does not push the configuration to the firewalls. To push the configuration, run the panorama-push-to-device-group command.

Returns commit status for a configuration.

Searches and returns a reference for the given object type and name. If no name is provided, all objects of the given type will be returned. Note this ONLY returns the object name and its location in the configuration hierachy, not the entire object.

Checks the download status of an app/threat dynamic update.

Gets the installation status of the app/threat dynamic update.

Creates an address object.

Creates a static or dynamic address group.

Creates an Anti-Spyware best practice profile.

Creates an antivirus best practice profile.

Creates a new application group rule in a Panorama/firewall instance.

Creates a custom URL category.

Creates an external dynamic list.

Creates a file blocking best practice profile.

Create a default master key that encrypts all the private keys and passwords in the configuration. This command is harmful because it invalidates the current API key and requires re-configuration of the integration instance.

Creates a new NAT rule in a Panorama/firewall instance.

Creates a new policy-based-forwarding (PBF) rule in a Panorama/firewall instance.

Creates a new redistribution-profile under a virtual-router for a Panorama/firewall instance.

Creates a policy rule.

Creates a new security profile group in Panorama.

Creates a service.

Creates a service group.

Creates a new tag in Panorama.

Creates a URL filtering rule.

Creates a URL filtering best practice profile.

Creates a vulnerability protection best practice profile.

Creates a WildFire analysis best practice profile.

Creates a custom block policy rule.

Deletes an address object.

Deletes an address group.

Deletes an application-group.

Deletes a custom URL category.

Deletes an external dynamic list.

Deletes a NAT rule.

Deletes a PBF rule.

Delete an exception to a Vulnerability Protection profile or Anti Spyware profile.

Deletes a redistribution-profile from a virtual-router.

Deletes a policy rule.

Deletes a security profile group from Panorama.

Deletes a service.

Deletes a service group.

Deletes a static route.

Deletes a tag from Panorama.

Deletes a URL filtering rule.

Reboots the firewall device.

Disables a policy rule.

Downloads the latest antivirus dynamic update.

Downloads the latest app/threat dynamic update.

Downloads the latest GlobalProtect Clientless VPN dynamic update.

Downloads the latest WildFire dynamic update.

Gets the download status of the target PAN-OS software.

Downloads the target PAN-OS software version to install on the target device.

Edits an address object.

Edits a static or dynamic address group.

Edits an application-group.

Adds or removes sites to and from a custom URL category.

Modifies an element of an external dynamic list.

Edits a NAT rule.

Edits a PBF rule.

Edit an exception to a Vulnerability Protection profile or Anti Spyware profile.

Edits a redistribution-profile in a virtual-router.

Edits a policy rule.

Edits the security profile group in Panorama.

Edits a service group.

Edits a tag in Panorama.

Edits a URL filtering rule.

Enforces Wildfire best practices to upload files to the maximum size, forwards all file types, and updates the schedule.

Exports a tech support file (TSF).

Returns address details for the supplied address name.

Gets details for the specified address group.

Get anti-spyware best practices.

Gets anti-virus best practices.

Gets the audit comment of a rule.

Gathers the name, expiration date, and expiration status of certificates configured locally on a Firewall or pushed from Panorama, as seen under Certificate Management.

Returns information for a custom URL category.

Returns information for an external dynamic list.

Gets file-blocking best practices.

Gets information about available PAN-OS licenses and their statuses.

Retrieves the data of a logs query.

Show the details of the default master key that encrypts all the private keys and passwords in the configuration.

Pull the merged config file.

Returns a PCAP file. The recommended maximum file size is 5 MB. If the limit is exceeded, you may need to connect to the firewall and run the scp export command in order to export the PCAP file. See the Palo Alto Networks documentation.

Gets the predefined threats list from a Firewall or Panorama and stores it as a JSON file in the context.

Gets rule hit counts from the firewall. When connected to Panorama this command can be run on any firewall managed by it.

Pull the running config file.

Gets information for the specified security profile.

Returns service details for the supplied service name.

Returns details for the specified service group.

Gets SSL decryption rules.

Returns the specified static route of a virtual router.

Deprecated. Use the pan-os-get-logs command instead.

Gets a URL category from URL filtering. This command is only available on firewall devices.

Returns a URL category from URL filtering. This command is only available on firewall devices.

Returns a URL category from URL filtering. This command is only available on firewall devices.

Returns information for a URL filtering rule.

Views URL filtering best practices.

Gets vulnerability-protection best practices.

Views WildFire best practices.

Retrieves the Wildfire configuration.

Checks that at least one log forwarding profile is configured according to best practices.

Checks that security rules are configured correctly.

Checks that configured security zones have correct settings.

Checks the configured anti-spyware profiles to ensure at least one meets best practices.

Checks the configured URL filtering profiles to ensure at least one meets best practices of blocking the following URL categories - abused-drugs, adult, command-and-control, compromised-websites, gambling, grayware, hacking, malware, phishing, questionable, ransomware, scanning-activity, weapons.

Checks the configured vulnerability profiles to ensure at least one meets best practices.

Returns all anti-spyware profiles that conform to best practices.

Returns a list of existing PANOS URL filtering objects that conform to best practices.

Returns all vulnerability profiles that conform to best practices.

Fixes log forwarding issues identified by pan-os-hygiene-check-log-forwarding.

Fixes security rules that have incorrect log settings by adding a log forwarding profile and setting.

Fixes security rules that have incorrect log settings by adding a log forwarding profile and setting.

Fixes security zones that are configured without a valid log forwarding profile.

Installs a specific content update file.

Installs the latest Antivirus update.

Installs the latest app/threat dynamic update.

Installs the latest GlobalProtect Clientless VPN dynamic update.

Installs the latest WildFire dynamic update.

Gets the installation status of the PAN-OS software.

Installs the target PAN-OS version on the specified target device.

Returns a list of address groups.

Returns a list of addresses.

Returns a list of application-groups of either a Panorama/firewall instance.

Returns a list of applications.

Retrieves a list of user-ID agents configured in the system.

Returns all device groups from Panorama (use only in Panorama instances).

Returns a list of external dynamic lists.

Returns a list of NAT rules of either a Panorama/firewall instance.

Returns a list of pbf-rules of either a Panorama/firewall instance.

Returns a list of all PCAP files by PCAP type. Not available for threat PCAPs.

List the exceptions in a Vulnerability Protection profile or Anti Spyware profile.

Returns a list of redistribution-profiles of a specific virtual-router of either a Panorama/firewall instance.

Returns a list of predefined Security Rules. (When passing a query, all other arguments are overridden. Make sure the query includes all the filters you want).

Returns a list of security profile groups from Panorama.

Returns a list of service groups.

Returns a list of addresses.

Lists the static routes of a virtual router.

Returns a list of tags from Panorama.

Returns a list of available templates. (To be used only in Panorama instances).

Returns a list of virtual routers of either a Panorama/firewall instance.

Changes the location of a policy rule.

Downloads the provided software version onto the device.

Gets all ARP tables from all firewalls in the topology.

Checks the devices for software that is available to be installed.

Retrieves all BGP peer information from the PAN-OS firewalls in the topology.

Gets operational information for all device groups in the Panorama topology, including group names, hierarchy, and associated firewalls. If no filter is provided, the command returns all device groups within the Panorama instance.

Get the device state from the provided device. Note; This will attempt to connect directly to the provided target to get the device state. If the IP address as reported in "show system info" is unreachable, this command will fail.

Gets global counter information from all the PAN-OS firewalls in the topology.

Gets the HA state and associated details from the given device and any other details.

Gets all the jobs from the devices in the environment, or a single job when the ID is specified.

Pulls all route summary information from the topology.

Pulls all route summary information from the topology.

Gets information from all PAN-OS systems in the topology.

Checks the status of the given device, checking whether it's up or down and if the operational mode is normal.

Gets the operational information of the template stacks in the topology.

Installs the given software version onto the device. Downloads the software first with panorama-download-panos-version.

Reboots the given device by host ID. Warning: This command has no confirmation and the device will immediately reboot. This command can be disruptive.

Checks the status of the given device, checking whether it's up or down and if the operational mode is normal.

Returns the push status for a configuration.

Pushes rules from PAN-OS to the configured device group. In order to push the configuration to Prisma Access managed tenants (single or multi tenancy), use the device group argument with the device group which is associated with the tenant ID. Validates if a push has been successful if polling="true".

Pushes the given PAN-OS template to the given devices or all devices that belong to the template.

Pushes the given PAN-OS template-stack to the given devices or all devices that belong to the template stack.

The query logs in Panorama.

Deprecated. Use the pan-os-query-logs command instead.

Refreshes the specified external dynamic list.

Registers IP addresses to a tag.

Registers users to a tag. This command is only available for PAN-OS version 9.x and above.

Removes a security profile to specific rules or rules with a specific tag.

Checks whether a session matches a specified security policy. This command is only available on firewall instances.

Show firewall device software version.

Gets location information for an IP address.

Shows the user ID interface configuration.

Shows the zones configuration.

Unregisters IP addresses from a tag.

Unregisters users from a tag. This command is only available for PAN-OS version 9.x and higher.

Update the default master key that encrypts all the private keys and passwords in the configuration. This command is harmful because it invalidates the current API key and requires re-configuration of the integration instance.

Uploads a content file to Panorama.

Sets default categories to block in the URL filtering profile.

Runs any command supported in the API.

Adds a static route.

Applies a security profile to specific rules or rules with a specific tag.

Sets a vulnerability signature to block mode.

Checks the PAN-OS software version from the repository.

Checks the status of a log query.

Deprecated. Use the pan-os-check-logs-status command instead.

Commits a configuration to the Palo Alto firewall or Panorama, but does not validate if the commit was successful. Committing to Panorama does not push the configuration to the firewalls. To push the configuration, run the panorama-push-to-device-group command.

Returns commit status for a configuration.

Checks the download status of a content update.

Gets the installation status of the content update.

Creates an address object.

Creates a static or dynamic address group.

Creates an anti-spyware best practice profile.

Creates an antivirus best practice profile.

Creates a custom URL category.

Creates an external dynamic list.

Creates a file blocking best practice profile.

Creates a policy rule.

Creates a service. Note: overrides the service if it already exists.

Creates a service group.

Creates a URL filtering rule.

Creates a URL filtering best practice profile.

Creates a vulnerability protection best practice profile.

Creates a WildFire analysis best practice profile.

Creates a custom block policy rule.

Deletes an address object.

Deletes an address group.

Deletes a custom URL category.

Deletes an external dynamic list.

Deletes a policy rule.

Deletes a service.

Deletes a service group.

Deletes a static route.

Deletes a URL filtering rule.

Reboots the firewall device.

Downloads the latest content update.

Gets the download status of the target PAN-OS software.

Downloads the target PAN-OS software version to install on the target device.

Edits a static or dynamic address group.

Adds or removes sites to and from a custom URL category.

Modifies an element of an external dynamic list.

Edits a policy rule.

Edits a service group.

Edits a URL filtering rule.

Enforces wildfire best practices to upload files to the maximum size, forwards all file types, and updates the schedule.

Returns address details for the supplied address name.

Gets details for the specified address group.

Gets anti-spyware best practices.

Get anti-virus best practices.

Returns information for a custom URL category.

Returns information for an external dynamic list.

Gets file-blocking best practices.

Gets information about available PAN-OS licenses and their statuses.

Retrieves the data of a logs query.

Returns information for a Panorama PCAP file. The recommended maximum file size is 5 MB. If the limit is exceeded, you may need to SSH the firewall and run the scp export command to export the PCAP file. See the Palo Alto Networks documentation.

Gets the predefined threats list from a firewall or Panorama and stores it as a JSON file in the context.

Gets information for the specified security profile.

Returns service details for the supplied service name.

Returns details for the specified service group.

Get SSL decryption rules.

Returns the specified static route of a virtual router.

Deprecated. Use the pan-os-get-logs command instead.

Gets a URL category from URL filtering. This command is only available on firewall devices.

Returns a URL category from URL filtering. This command is only available on firewall devices.

Returns a URL category from URL filtering. This command is only available on firewall devices.

Returns information for a URL filtering rule.

Views URL filtering best practices.

Gets vulnerability-protection best practices.

Views WildFire best practices.

Retrieves the Wildfire configuration.

Installs a specific content update file.

Installs the latest content update.

Gets the installation status of the PAN-OS software.

Installs the target PAN-OS version on the specified target device.

Returns a list of address groups.

Returns a list of addresses.

Returns a list of applications.

Retrieves list of user ID agents configured in the system.

Returns a list of external dynamic lists.

Returns a list of all PCAP files by PCAP type. Not available for threat PCAPs.

Returns a list of predefined security rules.

Returns a list of service groups.

Returns a list of addresses.

Lists the static routes of a virtual router.

Changes the location of a policy rule.

Returns the push status for a configuration.

Pushes rules from PAN-OS to the configured device group. In order to push the configuration to Prisma Access managed tenants (single or multi- tenancy), use the device group argument with the device group associated with the tenant ID.

Queries logs in Panorama.

Deprecated. Use the pan-os-query-logs command instead.

Refreshes the specified external dynamic list.

Registers IP addresses to a tag.

Registers users to a tag. This command is only available for PAN-OS version 9.x and higher.

Checks whether a session matches a specified security policy. This command is only available on firewall instances.

Shows the firewall device software version.

Gets location information for an IP address.

Shows the user ID interface configuration.

Shows the zones configuration.

Unregisters IP addresses from a tag.

Unregisters users from a tag. This command is only available for PAN-OS version 9.x and higher.

Uploads a content file to Panorama.

Sets default categories to block in the URL filtering profile.

Gets a URL category from URL filtering.