Panorama

This integration supports both Palo Alto Networks Panorama and Palo Alto Networks Firewall. You can create separate instances of each integration, and they are not necessarily related or dependent on one another.

This integration enables you to manage the Palo Alto Networks Firewall and Panorama. For more information see the PAN-OS documentation.
This integration was integrated and tested with versions 8.xx, 9.xx, 10.xx and 11.xx of Palo Alto Firewall and Palo Alto Panorama.

Use Cases

• Create custom security rules in Palo Alto Networks PAN-OS.
• Create and update address objects, address-groups, custom URL categories, and URL filtering objects.
• Use the URL Filtering category information from Palo Alto Networks to enrich URLs by checking the use_url_filtering parameter. A valid license for the Firewall is required.
• Get URL Filtering category information from Palo Alto. Request Change is a known Palo Alto limitation.
• Add URL filtering objects including overrides to Palo Alto Panorama and Firewall.
• Commit a configuration to Palo Alto Firewall and to Panorama, and push a configuration from Panorama to Pre-Defined Device-Groups of Firewalls.

• Block IP addresses using registered IP tags from PAN-OS without committing the PAN-OS instance. First you have to create a registered IP tag, DAG, and security rule, and commit the instance. You can then register additional IP addresses to the tag without committing the instance.

  1. Create a registered IP tag and add the necessary IP addresses by running the pan-os-register-ip-tag command.

  2. Create a dynamic address group (DAG), by running the pan-os-create-address-group command. Specify values for the following arguments: type=”dynamic”, match={ tagname }.

  3. Create a security rule using the DAG created in the previous step, by running the pan-os-create-rule command.

  4. Commit the PAN-OS instance by running the PanoramaCommitConfiguration playbook.

  5. You can now register IP addresses to, or unregister IP addresses from the IP tag by running the pan-os-register-ip-tag command, or pan-os-unregister-ip-tag command, respectively, without committing the PAN-OS instance.

• Create a predefined security profiles with the best practices by Palo Alto Networks.
• Get security profiles best practices as defined by Palo Alto Networks. For more information about Palo Alto Networks best practices, visit Palo Alto Networks best practices.
• Apply security profiles to specific rule.
• Set default categories to block in the URL filtering profile.

• Enforce WildFire best practice.

  1. Set file upload to the maximum size.

  2. Set WildFire Update Schedule to download and install updates every minute.

  3. All file types are forwarded.

Known Limitations

• Maximum commit queue length is 3. Running numerous Panorama commands simultaneously might cause errors.
• After running panorama-create- commands and the object is not committed, the panorama-edit commands or panorama-get commands might not run correctly.
• URL Filtering request change of a URL is not available via the API. Instead, you need to use the https://urlfiltering.paloaltonetworks.com website.
• If you do not specify a vsys (Firewall instances) or a device group (Panorama instances), you will only be able to execute the following commands.
  • pan-os-get-url-category
  • pan-os-commit
  • pan-os-push-to-device-group
  • pan-os-register-ip-tag
  • pan-os-unregister-ip-tag
  • pan-os-query-logs
  • pan-os-check-logs-status
  • pan-os-get-logs
  • pan-os-get-master-key-details
  • pan-os-create-master-key
  • pan-os-update-master-key
• The target argument is supported only in operational type commands. Meaning, you cannot use it with commit, logs, or PCAP commands.
• Creating or updating the encryption master key of Palo Alto Networks Firewall or Panorama invalidates the current API key and requires obtaining a new one. All subsequent commands will raise an “Invalid Credential” error until a new API key is obtained and the integration instance is updated accordingly.

Fetch Incidents

The Panorama integration now supports fetch incidents.
The incidents are fetched according to a number of different optional log type queries. The log types are: Traffic, Threat, URL, Data, Correlation, System, Wildfire, Decryption.

Max incidents per fetch

• The max incidents per fetch parameter specifies the maximum number of incidents to fetch per Log Type Query.
• Important note: Cortex XSOAR standard setup is not designed to handle many hundreds of new incidents every minute. Therefore, it is strongly recommended to narrow your query by log type, severity, or other criteria to ensure that each fetch cycle retrieves no more than 200 incidents at a time.

Log Type

The queries that will be included during the fetch are decided according to the “Log Type” parameter (Multiple select dropdown).

• Selecting “All” will use all the log type queries in the fetch.
• To choose a specific set of queries, select their log types from the dropdown (make sure “All” option is unselected).

Log Type Query

• Each log type has its own query field in the instance configuration.
• Note that the default query values has some example text in it, make sure to enter a valid query.
• Note: In case of multiple devices, for the sake of speed it is recommended to narrow the query to a specific device.
  For example: “and (device_name eq dummy_device)”.

Log Type Query Examples

Classifiers and Mappers

This integration supports a default Classifier (Panorama Classifier) and Mapper (Panorama Mapper) that handles incidents returned from the API.

Configure Panorama on Cortex XSOAR

1. Navigate to Settings > Integrations > Instances.
2. Search for Panorama.
3. Click Add instance to create and configure a new integration instance.

1. Click Test to validate the URLs, token, and connection.

Debugging in Panorama

In order to ease the process of understanding what parameters are required to be used in the !pan-os command, it is highly recommended to use the debugging mode in Panorama to get the correct structure of a request.

Debugging Methods:

• How to run a PAN-OS Web UI Debug
• Configuration (API)
• Use the API browser

Several Examples of !pan-os for a configuration type commands:

1) Create a new address object named test123 for the test device-group.

Given the following debug-log from PAN-OS Web UI Debug after creating an address through the Panorama UI:

`

`

The equivalent !pan-os command is:

`
!pan-os action=set xpath=/config/devices/entry[@name=’localhost.localdomain’]/device-group/entry[@name=’test’]/address/entry[@name=’test123’] type=config element=1.1.1.1
`

2) Modify an existing address group object named test12345 under the test device group to use a different address object.

Given the following debug-log from PAN-OS Web UI Debug after editing an address group through the Panorama UI to use a different address object:

`

`

The equivalent !pan-os command is:

`
!pan-os action=edit xpath=/config/devices/entry[@name=’localhost.localdomain’]/device-group/entry[@name=’test’]/address-group/entry[@name=’test12345’] type=config element=test123
`

3) Get a specific security pre-rule called test1.

Using the API browser, we can easily find the xpath for the security pre-rule object, therefore the pan-os command will be:

`
!pan-os xpath=/config/devices/entry[@name=’localhost.localdomain’]/device-group/entry[@name=’test’]/pre-rulebase/security/rules/entry[@name=’test1’], action=get type=config
`

Several examples of !pan-os for an operational type command:

1) Show system information - Can be viewed by using the API browser to get the structure of the request.

The equivalent !pan-os command is:

`
!pan-os type=op cmd=
`

2) Show information about all the jobs - Can be viewed by using the API browser to get the structure of the request.

The equivalent !pan-os command is:

`
!pan-os type=op cmd=
`

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

NOTE: The “create” commands function as UPSERT (UPDATE and INSERT), overriding existing data with new data if it already exists.

1. Run any command supported in the Panorama API: pan-os
2. Get pre-defined threats list from a Firewall or Panorama and stores as a JSON file in the context: panorama-get-predefined-threats-list
3. Commit a configuration: panorama-commit
4. Pushes rules from PAN-OS to the configured device group: panorama-push-to-device-group
5. Returns a list of addresses: panorama-list-addresses
6. Returns address details for the supplied address name: panorama-get-address
7. Creates an address object: panorama-create-address
8. Delete an address object: panorama-delete-address
9. Returns a list of address groups: panorama-list-address-groups
10. Get details for the specified address group: panorama-get-address-group
11. Creates a static or dynamic address group: panorama-create-address-group
12. Sets a vulnerability signature to block mode: panorama-block-vulnerability
13. Deletes an address group: panorama-delete-address-group
14. Edits a static or dynamic address group: panorama-edit-address-group
15. Returns a list of addresses: panorama-list-services
16. Returns service details for the supplied service name: panorama-get-service
17. Creates a service: panorama-create-service
18. Deletes a service: panorama-delete-service
19. Returns a list of service groups: panorama-list-service-groups
20. Returns details for the specified service group: panorama-get-service-group
21. Creates a service group: panorama-create-service-group
22. Deletes a service group: panorama-delete-service-group
23. Edit a service group: panorama-edit-service-group
24. Returns information for a custom URL category: panorama-get-custom-url-category
25. Creates a custom URL category: panorama-create-custom-url-category
26. Deletes a custom URL category: panorama-delete-custom-url-category
27. Adds or removes sites to and from a custom URL category: panorama-edit-custom-url-category
28. Gets a URL category from URL Filtering: panorama-get-url-category
29. Gets a URL information: url
30. Returns a URL category from URL Filtering in the cloud: panorama-get-url-category-from-cloud
31. Returns a URL category from URL Filtering on the host: panorama-get-url-category-from-host
32. Returns information for a URL filtering rule: panorama-get-url-filter
33. Creates a URL filtering rule: panorama-create-url-filter
34. Edit a URL filtering rule: panorama-edit-url-filter
35. Deletes a URL filtering rule: panorama-delete-url-filter
36. Returns a list of external dynamic lists: panorama-list-edls
37. Returns information for an external dynamic list: panorama-get-edl
38. Creates an external dynamic list: panorama-create-edl
39. Modifies an element of an external dynamic list: panorama-edit-edl
40. Deletes an external dynamic list: panorama-delete-edl
41. Refreshes the specified external dynamic list: panorama-refresh-edl
42. Creates a policy rule: panorama-create-rule
43. Creates a custom block policy rule: panorama-custom-block-rule
44. Changes the location of a policy rule: panorama-move-rule
45. Edits a policy rule: panorama-edit-rule
46. Deletes a policy rule: panorama-delete-rule
47. Returns a list of applications: panorama-list-applications
48. Returns commit status for a configuration: panorama-commit-status
49. Returns the push status for a configuration: panorama-push-status
50. Returns information for a Panorama PCAP file: panorama-get-pcap
51. Returns a list of all PCAP files by PCAP type: panorama-list-pcaps
52. Registers IP addresses to a tag: panorama-register-ip-tag
53. Unregisters IP addresses from a tag: panorama-unregister-ip-tag
54. Registers Users to a tag: panorama-register-user-tag
55. Unregisters Users from a tag: panorama-unregister-user-tag
56. Deprecated. Queries traffic logs: panorama-query-traffic-logs
57. Deprecated. Checks the query status of traffic logs: panorama-check-traffic-logs-status
58. Deprecated. Retrieves traffic log query data by job id: panorama-get-traffic-logs
59. Returns a list of predefined Security Rules: panorama-list-rules
60. Query logs in Panorama: panorama-query-logs
61. Checks the status of a logs query: panorama-check-logs-status
62. Retrieves the data of a logs query: panorama-get-logs
63. Checks whether a session matches the specified security policy: panorama-security-policy-match
64. Lists the static routes of a virtual router: panorama-list-static-routes
65. Returns the specified static route of a virtual router: panorama-get-static-route
66. Adds a static route: panorama-add-static-route
67. Deletes a static route: panorama-delete-static-route
68. Show firewall device software version: panorama-show-device-version
69. Downloads the latest content update: panorama-download-latest-content-update
70. Checks the download status of a content update: panorama-content-update-download-status
71. Installs the latest content update: panorama-install-latest-content-update
72. Gets the installation status of the content update: panorama-content-update-install-status
73. Checks the PAN-OS software version from the repository: panorama-check-latest-panos-software
74. Downloads the target PAN-OS software version to install on the target device: panorama-download-panos-version
75. Gets the download status of the target PAN-OS software: panorama-download-panos-status
76. Installs the target PAN-OS version on the specified target device: panorama-install-panos-version
77. Gets the installation status of the PAN-OS software: panorama-install-panos-status
78. Reboots the Firewall device: panorama-device-reboot
79. Gets location information for an IP address: panorama-show-location-ip
80. Gets information about available PAN-OS licenses and their statuses: panorama-get-licenses
81. Gets information for the specified security profile: panorama-get-security-profiles
82. Apply a security profile to specific rules or rules with a specific tag: panorama-apply-security-profile
83. Removes a security profile to specific rules or rules with a specific tag
84. Get SSL decryption rules: panorama-get-ssl-decryption-rules
85. Retrieves the Wildfire configuration: panorama-get-wildfire-configuration
86. Set default categories to block in the URL filtering profile: panorama-url-filtering-block-default-categories
87. Get anti-spyware best practices: panorama-get-anti-spyware-best-practice
88. Get file-blocking best practices: panorama-get-file-blocking-best-practice
89. Get anti-virus best practices: panorama-get-antivirus-best-practice
90. Get vulnerability-protection best practices: panorama-get-vulnerability-protection-best-practice
91. View WildFire best practices: panorama-get-wildfire-best-practice
92. View URL Filtering best practices: panorama-get-url-filtering-best-practice
93. Enforces wildfire best practices to upload files to the maximum size, forwards all file types, and updates the schedule: panorama-enforce-wildfire-best-practice
94. Creates an antivirus best practice profile: panorama-create-antivirus-best-practice-profile
95. Creates an Anti-Spyware best practice profile: panorama-create-anti-spyware-best-practice-profile
96. Creates a vulnerability protection best practice profile: panorama-create-vulnerability-best-practice-profile
97. Creates a URL filtering best practice profile: panorama-create-url-filtering-best-practice-profile
98. Creates a file blocking best practice profile: panorama-create-file-blocking-best-practice-profile
99. Creates a WildFire analysis best practice profile: panorama-create-wildfire-best-practice-profile
100. Shows the user ID interface configuration.
101. Shows the zones configuration.
102. Retrieves list of user-ID agents configured in the system.
103. Gets global counter information from all the PAN-OS firewalls in the topology.
104. Retrieves all BGP peer information from the PAN-OS firewalls in the topology.
105. Check the devices for software that is available to be installed.
106. Get the HA state and associated details from the given device and any other details.
107. Get all the jobs from the devices in the environment, or a single job when ID is specified.
108. Download The provided software version onto the device.
109. Download the running configuration
110. Download the merged configuration
111. Create Nat-rule
112. Create PBF-rule

pan-os

Run any command supported in the API.

Base Command

pan-os

Input

Context Output

There is no context output for this command.

Command Example

!pan-os xpath=“/config/devices/entry[@name=‘localhost.localdomain’]/template/entry[@name=‘test’]/config/devices/entry[@name=‘localhost.localdomain’]/network/profiles/zone-protection-profile/entry[@name=‘test’]/scan-white-list/entry[@name=‘test’]/ipv4" type=config action=edit element=“<ipv4>1.1.1.1</ipv4>”

Human Readable Output

Command was executed successfully.

pan-os-get-predefined-threats-list

Gets the pre-defined threats list from a Firewall or Panorama and stores as a JSON file in the context.

Base Command

pan-os-get-predefined-threats-list

Input

Context Output

Command Example

### pan-os-commit

***
Commits a configuration to the Palo Alto firewall or Panorama, validates if a commit was successful if using polling="true", otherwise does not validate if the commit was successful. Committing to Panorama does not push the configuration to the firewalls. To push the configuration, run the panorama-push-to-device-group command.

#### Base Command

`pan-os-commit`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| device-group | Panorama only. Limits the commit scope to the specified device group(s), so only pending changes for those device groups are committed. If omitted, all pending changes are committed. | Optional |
| template | Panorama only. Limits the commit scope to the specified template(s), so only pending changes for those templates are committed. If omitted, all pending changes are committed. | Optional |
| description | The commit description. | Optional |
| admin_name | The administrator name. To commit admin-level changes on a firewall, include the administrator name in the request. | Optional |
| force_commit | Forces a commit. Possible values are: true, false. | Optional |
| exclude_device_network_configuration | Performs a partial commit while excluding device and network configuration. Possible values are: true, false. | Optional |
| exclude_shared_objects | Performs a partial commit while excluding shared objects. Possible values are: true, false. | Optional |
| polling | Whether to use polling. Possible values are: true, false. Default is false. | Optional |
| commit_job_id | commit job ID to use in polling commands. (automatically filled by polling). | Optional |
| timeout | The timeout (in seconds) when polling. Default is 120. | Optional |
| interval_in_seconds | The interval (in seconds) when polling. Default is 10. | Optional |
| hide_polling_output | whether to hide the polling result (automatically filled by polling). | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Panorama.Commit.JobID | Number | The job ID to commit. |
| Panorama.Commit.Status | String | The commit status. |
| Panorama.Commit.Description | String | The commit description from the the command input. |
| Panorama.Commit.Scope | String | Whether the commit is partial. |
| Panorama.Commit.Details | String | The summary of the targeted device group and templates. |

#### Command example with polling

```!pan-os-commit description=test polling=true interval_in_seconds=5 timeout=60```

#### Human Readable Output

>Waiting for commit "test" with job ID 12345 to finish...
>
>### Commit Status
>
>|JobID|Status| Description
>|---|---|---|
>| 12345 | Success | test

#### Context Example

```json
{
    "Panorama": {
        "Commit": {
            "JobID": "12345",
            "Status": "Success",
            "Description": "test",
            "Scope": "Full",
            "Details": "Full commit"
        }
    }
}

Command example without polling

!pan-os-commit description=test

Human Readable Output

Commit Status

JobID	Status	Description
12345	Pending	test

Context Example

{
    "Panorama": {
        "Commit": {
            "JobID": "12345",
            "Status": "Pending",
            "Description": "test",
            "Scope": "Full",
            "Details": "Full commit"
        }
    }
}

pan-os-push-to-device-group

Pushes rules from PAN-OS to the configured device group. In order to push the configuration to Prisma Access managed tenants (single or multi tenancy), use the device group argument with the device group which is associated with the tenant ID. Validates if a push has been successful if polling=”true”.

Base Command

pan-os-push-to-device-group

Input

Context Output

Command example with polling=true

!pan-os-push-to-device-group description=test polling=true interval_in_seconds=5 timeout=60

Context Example

{
    "Panorama": {
        "Push": {
            "Details": [
                "commit succeeded with warnings",
                "commit succeeded with warnings"
            ],
            "Errors": ,
            "JobID": "31377",
            "Status": "Completed",
            "Warnings": [
                "Interface loopback.645 has no zone configuration.",
                "External Dynamic List test_pb_domain_edl_DONT_DEL is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List Cortex XSOAR Remediation - IP EDL-ip-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List Cortex XSOAR Remediation - URL EDL-url-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List Cortex XSOAR Remediation - URL EDL tamarcat3-url-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List Cortex XSOAR Remediation - IP EDL tamarcat3-ip-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List minemeld is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List edl-webinar-malicious-urls-OLD is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List edl-webinar-malicious-ips is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List edl-webinar-malicious-domains is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "Warning: No valid Antivirus content package exists",
                "(Module: device)"
            ]
        }
    }
}

Human Readable Output

Waiting for Job-ID 31374 to finish push changes to device-group Lab-Devices..

Push to Device Group status

JobID	Status	Details	Errors	Warnings
31377	Completed	commit succeeded with warnings, commit succeeded with warnings		Interface loopback.645 has no zone configuration., External Dynamic List test_pb_domain_edl_DONT_DEL is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List Cortex XSOAR Remediation - IP EDL-ip-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List Cortex XSOAR Remediation - URL EDL-url-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List Cortex XSOAR Remediation - URL EDL tamarcat3-url-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List Cortex XSOAR Remediation - IP EDL tamarcat3-ip-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List minemeld is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List edl-webinar-malicious-urls-OLD is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List edl-webinar-malicious-ips is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List edl-webinar-malicious-domains is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., Warning: No valid Antivirus content package exists, (Module: device)

Command example with polling=false

!pan-os-push-to-device-group description=test polling=false

Human Readable Output

Push to Device Group status

JobID	Status	Description
113198	Pending	test

Context Example

{
    "Panorama": {
        "Push": {
          "JobID": "113198",
          "Status": "Pending",
          "Description": "test",
          "DeviceGroup": "device group name"
        }
    }
}

pan-os-list-addresses

Returns a list of addresses.

Base Command

pan-os-list-addresses

Input

Context Output

Command Example

#### Context Example

```json
{
    "Panorama": {
        "Addresses": [
            {
                "IP_Netmask": "10.10.10.1/24",
                "Name": "Demisto address"
            },
            {
                "Description": "a",
                "IP_Netmask": "1.1.1.1",
                "Name": "test1"
            }
        ]
    }
}

Human Readable Output

Addresses

Name	IP_Netmask	IP_Range	FQDN
Demisto address	10.10.10.1/24
test1	1.1.1.1

pan-os-get-address

Returns address details for the supplied address name.

Base Command

pan-os-get-address

Input

Context Output

Command Example

!pan-os-get-address name="Demisto address"

Context Example

{
    "Panorama": {
        "Addresses": {
            "IP_Netmask": "10.10.10.1/24",
            "Name": "Demisto address"
        }
    }
}

Human Readable Output

Address

Name	IP_Netmask
Demisto address	10.10.10.1/24

pan-os-create-address

Creates an address object.

Base Command

pan-os-create-address

Input

Context Output

Command Example

!pan-os-create-address name="address_test_pb" description="just a desc" ip_range="10.10.10.9-10.10.10.10"

Context Example

{
    "Panorama": {
        "Addresses": {
            "Description": "just a desc",
            "IP_Range": "10.10.10.9-10.10.10.10",
            "Name": "address_test_pb"
        }
    }
}

Human Readable Output

Address was created successfully.

pan-os-delete-address

Delete an address object

Base Command

pan-os-delete-address

Input

Context Output

Command Example

!pan-os-delete-address name="address_test_pb"

Context Example

{
    "Panorama": {
        "Addresses": {
            "Name": "address_test_pb"
        }
    }
}

Human Readable Output

Address was deleted successfully.

pan-os-list-address-groups

Returns a list of address groups.

Base Command

pan-os-list-address-groups

Input

Context Output

Command Example

#### Context Example

```json
{
    "Panorama": {
        "AddressGroups": [
            {
                "Match": "2.2.2.2",
                "Name": "a_g_1",
                "Type": "dynamic"
            },
            {
                "Addresses": [
                    "Demisto address",
                    "test3",
                    "test_demo3"
                ],
                "Name": "Demisto group",
                "Type": "static"
            },
            {
                "Description": "jajja",
                "Match": "4.4.4.4",
                "Name": "dynamic2",
                "Type": "dynamic"
            },
            {
                "Addresses": [
                    "test4",
                    "test2"
                ],
                "Name": "static2",
                "Type": "static"
            }
        ]
    }
}

Human Readable Output

Address groups

Name	Type	Addresses	Match	Description	Tags
a_g_1	dynamic		2.2.2.2
Demisto group	static	Demisto address, test3, test_demo3
dynamic2	dynamic		4.4.4.4	jajja
static2	static	test4, test2

pan-os-get-address-group

Get details for the specified address group

Base Command

pan-os-get-address-group

Input

Context Output

Command Example

!pan-os-get-address-group name=suspicious_address_group

Human Readable Output

Address groups

Name	Type	Addresses	Match	Description
suspicious_address_group	dynamic	1.1.1.1	this ip is very bad

pan-os-create-address-group

Creates a static or dynamic address group.

Base Command

pan-os-create-address-group

Input

Context Output

Command Example

!pan-os-create-address-group name=suspicious_address_group type=dynamic match=1.1.1.1 description="this ip is very bad"

Context Example

{
    "Panorama": {
        "AddressGroups": {
            "Description": "this ip is very bad",
            "Match": "1.1.1.1",
            "Name": "suspicious_address_group",
            "Type": "dynamic"
        }
    }
}

Human Readable Output

Address group was created successfully.

pan-os-block-vulnerability

Sets a vulnerability signature to block mode.

Base Command

pan-os-block-vulnerability

Input

Context Output

Command Example

!pan-os-block-vulnerability threat_id=18250 vulnerability_profile=name

Human Readable Output

Threat with ID 18250 overridden.

pan-os-delete-address-group

Deletes an address group.

Base Command

pan-os-delete-address-group

Input

Context Output

Command Example

!pan-os-delete-address-group name="dynamic_address_group_test_pb3"

Human Readable Output

Address group was deleted successfully

pan-os-edit-address-group

Edits a static or dynamic address group.

Base Command

pan-os-edit-address-group

Input

Context Output

pan-os-list-services

Returns a list of addresses.

Base Command

pan-os-list-services

Input

Context Output

Command Example

#### Context Example

```json
{
    "Panorama": {
        "Services": [
            {
                "Description": "rgfg",
                "DestinationPort": "55",
                "Name": "demisto_service1",
                "Protocol": "tcp",
                "SourcePort": "567-569"
            },
            {
                "Description": "mojo",
                "DestinationPort": "55",
                "Name": "demi_service_test_pb",
                "Protocol": "sctp",
                "SourcePort": "60"
            },
        ]
    }
}

Human Readable Output

Services

Name	Protocol	SourcePort	DestinationPort	Description
demisto_service1	tcp	567-569	55	rgfg
demi_service_test_pb	sctp	60	55	mojo

pan-os-get-service

Returns service details for the supplied service name.

Base Command

pan-os-get-service

Input

Context Output

Command Example

!pan-os-get-service name=demisto_service1

Human Readable Output

Address

Name	Protocol	SourcePort	DestinationPort	Description
demisto_service1	tcp	567-569	55	rgfg

pan-os-create-service

Creates a service.

Base Command

pan-os-create-service

Input

Context Output

Command Example

!pan-os-create-service name=guy_ser3 protocol=udp destination_port=36 description=bfds

Context Example

{
    "Panorama": {
        "Services": {
            "Description": "bfds",
            "DestinationPort": "36",
            "Name": "guy_ser3",
            "Protocol": "udp"
        }
    }
}

Human Readable Output

Service was created successfully.

pan-os-delete-service

Deletes a service.

Base Command

pan-os-delete-service

Input

Context Output

Command Example

!pan-os-delete-service name=guy_ser3

Context Example

{
    "Panorama": {
        "Services": {
            "Name": "guy_ser3"
        }
    }
}

Human Readable Output

Service was deleted successfully.

pan-os-list-service-groups

Returns a list of service groups.

Base Command

pan-os-list-service-groups

Input

Context Output

Command Example

#### Context Example

```json
{
    "Panorama": {
        "ServiceGroups": [
            {
                "Name": "demisto_default_service_groups",
                "Services": [
                    "service-http",
                    "service-https"
                ]
            },
            {
                "Name": "demisto_test_pb_service_group",
                "Services": "serice_tcp_test_pb"
            }
        ]
    }
}

Human Readable Output

Service groups

Name	Services
demisto_default_service_groups	service-http, service-https
demisto_test_pb_service_group	service_tcp_test_pb

pan-os-get-service-group

Returns details for the specified service group.

Base Command

pan-os-get-service-group

Input

Context Output

Command Example

!pan-os-get-service-group name=ser_group6

Context Example

{
    "Panorama": {
        "ServiceGroups": {
            "Name": "ser_group6",
            "Services": [
                "serice_tcp_test_pb",
                "demi_service_test_pb"
            ]
        }
    }
}

Human Readable Output

Service group

Name	Services
ser_group6	serice_tcp_test_pb, demi_service_test_pb

pan-os-create-service-group

Creates a service group.

Base Command

pan-os-create-service-group

Input

Context Output

Command Example

!pan-os-create-service-group name=lalush_sg4 services=`["demisto_service1","demi_service_test_pb"]

pan-os-delete-service-group

Deletes a service group.

Base Command

pan-os-delete-service-group

Input

Context Output

Command Example

!pan-os-delete-service-group name=lalush_sg4

pan-os-edit-service-group

Edit a service group.

Base Command

pan-os-edit-service-group

Input

Context Output

Command Example

!pan-os-edit-service-group name=lalush_sg4 services_to_remove=`["serice_udp_test_pb","demisto_service1"]

Human Readable Output

Service group was edited successfully

pan-os-get-custom-url-category

Returns information for a custom URL category.

Base Command

pan-os-get-custom-url-category

Input

Context Output

Command Example

!pan-os-get-custom-url-category name=my_personal_url_category

Human Readable Output

Custom URL Category

Name	Sites	Description
my_personal_url_category	thepill.com, abortion.com	just a desc

pan-os-create-custom-url-category

Creates a custom URL category.

Base Command

pan-os-create-custom-url-category

Input

Context Output

Command Example

!pan-os-create-custom-url-category name=suspicious_address_group sites=["thepill.com","abortion.com"] description=momo

Context Example

{
    "Panorama": {
        "CustomURLCategory": {
            "Description": "momo",
            "Name": "suspicious_address_group",
            "Sites": [
                "thepill.com",
                "abortion.com"
            ]
        }
    }
}

Human Readable Output

Created Custom URL Category

Name	Sites	Description
suspicious_address_group	thepill.com, abortion.com	momo

pan-os-delete-custom-url-category

Deletes a custom URL category.

Base Command

pan-os-delete-custom-url-category

Input

Context Output

Command Example

!pan-os-delete-custom-url-category name=suspicious_address_group

Context Example

{
    "Panorama": {
        "CustomURLCategory": {
            "Name": "suspicious_address_group"
        }
    }
}

Human Readable Output

Custom URL category was deleted successfully.

pan-os-edit-custom-url-category

Adds or removes sites to and from a custom URL category.

Base Command

pan-os-edit-custom-url-category

Input

Context Output

pan-os-get-url-category

Gets a URL category from URL Filtering. This command is only available on Firewall devices.

Base Command

pan-os-get-url-category

Input

Context Output

Command Example

!pan-os-get-url-category url="poker.com"

Context Example

{
    "DBotScore": {
        "Indicator": "poker.com",
        "Score": 1,
        "Type": "url",
        "Vendor": "PAN-OS"
    },
    "Panorama": {
        "URLFilter": {
            "Category": "gambling",
            "URL": [
                "poker.com"
            ]
        }
    },
    "URL": {
        "Category": "gambling",
        "Data": "poker.com"
    }
}

Human Readable Output

URL Filtering

URL	Category
poker.com	gambling

url

Gets a URL category from URL Filtering. This command is only available on Firewall devices.

Base Command

url

Input

Context Output

pan-os-get-url-category-from-cloud

Returns a URL category from URL filtering. This command is only available on Firewall devices.

Base Command

pan-os-get-url-category-from-cloud

Input

Context Output

Command Example

!pan-os-get-url-category-from-cloud url=google.com

Human Readable Output

URL Filtering from cloud

URL	Category
google.com	search-engines

pan-os-get-url-category-from-host

Returns a URL category from URL Filtering.

Base Command

pan-os-get-url-category-from-host

Input

Context Output

Command Example

!pan-os-get-url-category-from-host url=google.com

Human Readable Output

URL Filtering from host

URL	Category
google.com	search-engines

pan-os-get-url-filter

Returns information for a URL filtering rule.

Base Command

pan-os-get-url-filter

Input

Context Output

Command Example

!pan-os-get-url-filter name=demisto_default_url_filter

Human Readable Output

URL Filter

Name	Category	OverrideAllowList	Description
demisto_default_url_filter	{‘Action’: ‘block’, ‘Name’: u’abortion’}, {‘Action’: ‘block’, ‘Name’: u’abuse-drugs’}	888.com, 777.com	gres

pan-os-create-url-filter

Creates a URL filtering rule.

Base Command

pan-os-create-url-filter

Input

Context Output

Command Example

!pan-os-create-url-filter action=block name=gambling_url url_category=gambling

Context Example

{
    "Panorama": {
        "URLFilter": {
            "Category": [
                {
                    "Action": "block",
                    "Name": "gambling"
                }
            ],
            "Name": "gambling_url"
        }
    }
}

Human Readable Output

URL Filter was created successfully.

pan-os-edit-url-filter

Edit a URL filtering rule.

Base Command

pan-os-edit-url-filter

Input

Context Output

Command Example

!pan-os-edit-url-filter name=demisto_default_url_filter element_to_change=override_allow_list element_value="poker.com" add_remove_element=add

Human Readable Output

URL Filter was edited successfully

pan-os-delete-url-filter

Deletes a URL filtering rule.

Base Command

pan-os-delete-url-filter

Input

Context Output

Command Example

!pan-os-delete-url-filter name=gambling_url

Context Example

{
    "Panorama": {
        "URLFilter": {
            "Name": "gambling_url"
        }
    }
}

Human Readable Output

URL Filter was deleted successfully.

pan-os-list-edls

Returns a list of external dynamic lists.

Base Command

pan-os-list-edls

Input

Context Output

Command Example

#### Context Example

```json
{
    "Panorama": {
        "EDL": [
            {
                "Description": "6u4ju7",
                "Name": "blabla3",
                "Recurring": "hourly",
                "Type": "url",
                "URL": "lolo"
            },
            {
                "Description": "ip",
                "Name": "bad_ip_edl_demisot_web_server",
                "Recurring": "five-minute",
                "Type": "ip",
                "URL": "http://192.168.1.15/files/very_bad_ip2.txt"
            }
        ]
    }
}

Human Readable Output

External Dynamic Lists

Name	Type	URL	Recurring	Description
blabla3	url	lolo	hourly	6u4ju7
bad_ip_edl_demisot_web_server	ip	http://192.168.1.15/files/very_bad_ip2.txt	five-minute	ip

pan-os-get-edl

Returns information for an external dynamic list

Base Command

pan-os-get-edl

Input

Context Output

Command Example

!pan-os-get-edl name=test_pb_domain_edl_DONT_DEL

Context Example

{
    "Panorama": {
        "EDL": {
            "Description": "new description3",
            "Name": "test_pb_domain_edl_DONT_DEL",
            "Recurring": "hourly",
            "Type": "url",
            "URL": "https://test_pb_task.not.real"
        }
    }
}

Human Readable Output

External Dynamic List

Name	Type	URL	Recurring	Description
test_pb_domain_edl_DONT_DEL	url	https://test_pb_task.not.real	hourly	new description3

pan-os-create-edl

Creates an external dynamic list.

Base Command

pan-os-create-edl

Input

Context Output

Command Example

!pan-os-create-edl name=new_EDL recurring="five-minute" type=url url="gmail.com"

Context Example

{
    "Panorama": {
        "EDL": {
            "Name": "new_EDL",
            "Recurring": "five-minute",
            "Type": "url",
            "URL": "gmail.com"
        }
    }
}

Human Readable Output

External Dynamic List was created successfully.

pan-os-edit-edl

Modifies an element of an external dynamic list.

Base Command

pan-os-edit-edl

Input

Context Output

Command Example

!pan-os-edit-edl name=test_pb_domain_edl_DONT_DEL element_to_change=description element_value="new description3"

Context Example

{
    "Panorama": {
        "EDL": {
            "Description": "new description3",
            "Name": "test_pb_domain_edl_DONT_DEL"
        }
    }
}

Human Readable Output

External Dynamic List was edited successfully

pan-os-delete-edl

Deletes an external dynamic list.

Base Command

pan-os-delete-edl

Input

Context Output

Command Example

!pan-os-delete-edl name=new_EDL

Context Example

{
    "Panorama": {
        "EDL": {
            "Name": "new_EDL"
        }
    }
}

Human Readable Output

External Dynamic List was deleted successfully

pan-os-refresh-edl

Refreshes the specified external dynamic list.

Base Command

pan-os-refresh-edl

Input

Context Output

There is no context output for this command.

Command Example

!pan-os-refresh-edl name=test_pb_domain_edl_DONT_DEL

Human Readable Output

Refreshed External Dynamic List successfully

pan-os-create-rule

Creates a policy rule.

Base Command

pan-os-create-rule

Input

Context Output

Command Example

!pan-os-create-rule rulename="block_bad_application" description="do not play at work" action="deny" application="fortnite"

Context Example

{
    "Panorama": {
        "SecurityRule": {
            "Action": "deny",
            "Application": "fortnite",
            "Description": "do not play at work",
            "Disabled": "No",
            "Name": "block_bad_application",
            "SourceUser": "any"
        }
    }
}

Human Readable Output

Rule configured successfully.

pan-os-custom-block-rule

Creates a custom block policy rule.

Base Command

pan-os-custom-block-rule

Input

Context Output

Command Example

!pan-os-custom-block-rule object_type=application object_value=fortnite

Context Example

{
    "Panorama": {
        "SecurityRule": {
            "Application": [
                "fortnite"
            ],
            "Direction": "both",
            "Disabled": false,
            "Name": "demisto-9c9ed15a"
        }
    }
}

Human Readable Output

Object was blocked successfully.

pan-os-move-rule

Changes the location of a policy rule.

Base Command

pan-os-move-rule

Input

Context Output

Command Example

!pan-os-move-rule rulename="test_rule3" where="bottom"

Human Readable Output

Rule test_rule3 moved successfully

pan-os-edit-rule

Edits a policy rule.

Base Command

pan-os-edit-rule

Input

Context Output

Command Example

!pan-os-edit-rule rulename="block_bad_application" element_to_change=action element_value=drop

Context Example

{
    "Panorama": {
        "SecurityRule": {
            "Action": "drop",
            "Name": "block_bad_application"
        }
    }
}

Human Readable Output

Rule edited successfully.

pan-os-delete-rule

Deletes a policy rule.

Base Command

pan-os-delete-rule

Input

Context Output

pan-os-list-applications

Returns a list of applications.

Base Command

pan-os-list-applications

Input

Context Output

Command Example

#### Context Example

```json
{
    "Panorama": {
        "Applications": {
            "Description": "lala",
            "Id": null,
            "Name": "demisto_fw_app3",
            "Risk": "1",
            "SubCategory": "ip-protocol",
            "Technology": "peer-to-peer"
        }
    }
}

Human Readable Output

Applications

Id	Name	Risk	Category	SubCategory	Technology	Description
	demisto_fw_app3	1		ip-protocol	peer-to-peer	lala

pan-os-push-status

Returns the push status for a configuration.

Base Command

pan-os-push-status

Input

Context Output

Command example

!pan-os-push-status job_id=31377

Context Example

{
    "Panorama": {
        "Push": {
            "Details": [
                "commit succeeded with warnings",
                "commit succeeded with warnings"
            ],
            "Errors": [],
            "JobID": "31377",
            "Status": "Completed",
            "Warnings": [
                "Interface loopback.645 has no zone configuration.",
                "External Dynamic List test_pb_domain_edl_DONT_DEL is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List Cortex XSOAR Remediation - IP EDL-ip-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List Cortex XSOAR Remediation - URL EDL-url-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List Cortex XSOAR Remediation - URL EDL tamarcat3-url-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List Cortex XSOAR Remediation - IP EDL tamarcat3-ip-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List minemeld is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List edl-webinar-malicious-urls-OLD is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List edl-webinar-malicious-ips is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "External Dynamic List edl-webinar-malicious-domains is configured with no certificate profile. Please select a certificate profile for performing server certificate validation.",
                "Warning: No valid Antivirus content package exists",
                "(Module: device)"
            ]
        }
    }
}

Human Readable Output

Push to Device Group status

JobID	Status	Details	Errors	Warnings
31377	Completed	commit succeeded with warnings, commit succeeded with warnings		Interface loopback.645 has no zone configuration., External Dynamic List test_pb_domain_edl_DONT_DEL is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List Cortex XSOAR Remediation - IP EDL-ip-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List Cortex XSOAR Remediation - URL EDL-url-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List Cortex XSOAR Remediation - URL EDL tamarcat3-url-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List Cortex XSOAR Remediation - IP EDL tamarcat3-ip-edl-object is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List minemeld is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List edl-webinar-malicious-urls-OLD is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List edl-webinar-malicious-ips is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., External Dynamic List edl-webinar-malicious-domains is configured with no certificate profile. Please select a certificate profile for performing server certificate validation., Warning: No valid Antivirus content package exists, (Module: device)

pan-os-get-pcap

Returns information for a Panorama PCAP file. The recommended maximum file size is 5 MB. If the limit is exceeded, you might need to SSH the firewall and run the scp export command to export the PCAP file. For more information, see the Palo Alto Networks documentation.

When trying to retrieve threat-PCAPs of a firewall through a panorama instance, be sure to forward the log containing the threat PCAP file from the firewall to the panorama instance.

For more information follow instructions from here.

Base Command

pan-os-get-pcap

PCAPs api docs

You can find information about required/optional arguments for each pcap type here:

Input

Context Output

Command Example

!pan-os-get-pcap pcapType="filter-pcap" from=pcap_test

pan-os-list-pcaps

Returns a list of all PCAP files by PCAP type. Not available for threat PCAPs.

Base Command

pan-os-list-pcaps

Input

Context Output

There is no context output for this command.

Command Example

!pan-os-list-pcaps pcapType=“filter-pcap”

Human Readable Output

List of Pcaps

Pcap name
pcam_name

pan-os-register-ip-tag

Registers IP addresses to a tag.

Base Command

pan-os-register-ip-tag

Input

Context Output

Command Example

!pan-os-register-ip-tag tag=tag02 IPs=[“10.0.0.13”,“10.0.0.14”]

Human Readable Output

Registered ip-tag successfully

pan-os-unregister-ip-tag

Unregisters IP addresses from a tag.

Base Command

pan-os-unregister-ip-tag

Input

Context Output

There is no context output for this command.

Command Example

!pan-os-unregister-ip-tag tag=tag02 IPs=["10.0.0.13","10.0.0.14"]

Human Readable Output

Unregistered ip-tag successfully

pan-os-register-user-tag

Registers users to a tag. This command is only available for PAN-OS version 9.x and above.

Base Command

pan-os-register-user-tag

Input

Context Output

Command Example

!pan-os-register-user-tag tag-tag02 Users=Username

Human Readable Output

Registered user-tag successfully

pan-os-unregister-user-tag

Unregisters users from a tag. This command is only available for PAN-OS version 9.x and above.

Base Command

pan-os-unregister-user-tag

Input

Context Output

There is no context output for this command.

Command Example

!pan-os-unregister-user-tag tag-tag02 Users=Username

Human Readable Output

Unregistered user-tag successfully

pan-os-query-traffic-logs

Deprecated. Queries traffic logs.

Base Command

pan-os-query-traffic-logs

Input

Context Output

Command Example

!pan-os-query-traffic-logs query="" number_of_logs="100" direction="backward" source="" destination="" receive_time="" application="" to_port="" action="allow"

Human Readable Output

Query Traffic Logs

JobID	Status
1858	Pending

pan-os-check-traffic-logs-status

Deprecated. Checks the query status of traffic logs.

Base Command

pan-os-check-traffic-logs-status

Input

Context Output

Command Example

!pan-os-check-traffic-logs-status job_id="1865"

Human Readable Output

Query Traffic Logs status

JobID	Status
1858	Pending

pan-os-get-traffic-logs

Deprecated. Retrieves traffic log query data by job id.

Base Command

pan-os-get-traffic-logs

Input

Context Output

Command Example

!pan-os-get-traffic-logs job_id="1865"

pan-os-list-rules

Returns a list of predefined Security Rules. (When passing a query, all other arguments are overridden. Make sure the query includes all the filters you want).

Base Command

pan-os-list-rules

Input

Context Output

Command Example

!pan-os-list-rules pre_post=“pre-rulebase”

Context Example

{
    "Panorama": {
        "SecurityRule": [
            {
                "DeviceGroup": "TestDevice",
                "Location": "TestDevice",
                "NegateDestination": "",
                "Disabled": "no",
                "ICMPUnreachable": "",
                "Description": "",
                "GroupTag": "",
                "LogForwardingProfile": "",
                "NegateSource": "",
                "SecurityProfileGroup": "TestGroup",
                "SecurityProfile": {
                    "url-filtering": "",
                    "data-filtering": "",
                    "file-blocking": "",
                    "vulnerability": "",
                    "wildfire-analysis": "",
                    "spyware": "",
                    "virus": ""
                },
                "Target": {
                    "devices": "007051000185487",
                    "negate": "no"
                },
                "Name": "block rule",
                "Type": "",
                "From": [
                    "TestName",
                    "TestName2"
                ],
                "DestinationDevice": "any",
                "Action": "drop",
                "SourceDevice": "any",
                "Tags": [
                    "TestTag1",
                    "TestTag2",
                    "TestTag3"
                ],
                "SourceUser": "any",
                "Application": [
                    "cortex-xdr",
                    "jira",
                    "zoom"
                ],
                "Service": "application-default",
                "To": [
                    "TestName",
                    "TestName2"
                ],
                "Source": [
                    "1.1.1.1",
                    "8.8.4.4",
                    "8.8.8.8"
                ],
                "CustomUrlCategory": [
                    "abortion",
                    "adult",
                    "alcohol-and-tobacco",
                    "hacking"
                ],
                "Destination": [
                    "1.1.1.1",
                    "8.8.8.8"
                ],
                "Options": {
                    "LogAtSessionStart": "",
                    "LogForwarding": "",
                    "Schedule": "",
                    "QoSMarking": "",
                    "DisableServerResponseInspection": ""
                }
            },
            {
                "DeviceGroup": "TestDevice",
                "Location": "TestDevice",
                "NegateDestination": "",
                "Disabled": "",
                "ICMPUnreachable": "yes",
                "Description": "bbbbbbbbbb",
                "GroupTag": "TestGroupTag",
                "LogForwardingProfile": "Log forwarding for SA",
                "NegateSource": "",
                "SecurityProfileGroup": "",
                "SecurityProfile": {
                    "url-filtering": "default",
                    "spyware": "testing",
                    "virus": "default",
                    "data-filtering": "",
                    "file-blocking": "",
                    "vulnerability": "",
                    "wildfire-analysis": ""
                },
                "Target": {
                    "devices": [
                        "007051000185487",
                        "007051000188986"
                    ],
                    "negate": "no"
                },
                "Name": "jl-test-1",
                "Type": "intrazone",
                "From": "internal",
                "DestinationDevice": "bad nam",
                "Action": "reset-server",
                "SourceDevice": "good name",
                "Tags": [
                    "APIiiiiii",
                    "test2shared"
                ],
                "SourceUser": "me",
                "Application": "8x8",
                "Service": [
                    "new group",
                    "service-http",
                    "service-https"
                ],
                "To": "internal",
                "Source": "1.1.1.1",
                "CustomUrlCategory": [
                    "alcohol-and-tobacco",
                    "auctions"
                ],
                "Destination": "my_shared_address_object_test",
                "Options": {
                    "LogAtSessionStart": "yes",
                    "LogForwarding": "Log forwarding for SA",
                    "Schedule": "test-schedule",
                    "QoSMarking": "ip-precedence",
                    "DisableServerResponseInspection": "yes"
                }
            }
        ]
    }
}

Human Readable Output

Security Rules

pan-os-query-logs

The query logs in Panorama.

Base Command

pan-os-query-logs

Input

Context Output

| Path | Type | Description |
| — | — | — |
| Panorama.Monitor.JobID | String | The job ID of the logs query. |
| Panorama.Monitor.Status | String | The status of the logs query. |
| Panorama.Monitor.Message | String | The message of the logs query. |
| Panorama.Monitor.Logs.Action | String | The action taken for the session. Can be “alert”, “allow”, “deny”, “drop”, “drop-all-packets”, “reset-client”, “reset-server”, “reset-both”, or “block-url”. |
| Panorama.Monitor.Logs.Application | String | The application associated with the session. |
| Panorama.Monitor.Logs.Category | String | The URL category of the URL subtype. For WildFire subtype, it is the verdict on the file, and can be either “malicious”, “phishing”, “grayware”, or “benign”. For other subtypes, the value is “any”. |
| Panorama.Monitor.Logs.DeviceName | String | The hostname of the firewall on which the session was logged. |
| Panorama.Monitor.Logs.DestinationAddress | String | The original session destination IP address. |
| Panorama.Monitor.Logs.DestinationUser | String | The username of the user to which the session was destined. |
| Panorama.Monitor.Logs.DestinationCountry | String | The destination country or internal region for private addresses. Maximum length is 32 bytes. |
| Panorama.Monitor.Logs.DestinationPort | String | The destination port utilized by the session. |
| Panorama.Monitor.Logs.FileDigest | String | Only for the WildFire subtype, all other types do not use this field. The filedigest string shows the binary hash of the file sent to be analyzed by the WildFire service. |
| Panorama.Monitor.Logs.FileName | String | File name or file type when the subtype is file.
File name when the subtype is virus.
File name when the subtype is wildfire-virus.
File name when the subtype is wildfire. |
| Panorama.Monitor.Logs.FileType | String | Only for the WildFire subtype, all other types do not use this field.
Specifies the type of file that the firewall forwarded for WildFire analysis. |
| Panorama.Monitor.Logs.FromZone | String | The zone from which the session was sourced. |
| Panorama.Monitor.Logs.URLOrFilename | String | The actual URL when the subtype is url.
The file name or file type when the subtype is file.
The file name when the subtype is virus.
The file name when the subtype is wildfire-virus.
The file name when the subtype is wildfire.
The URL or file name when the subtype is vulnerability (if applicable). |
| Panorama.Monitor.Logs.NATDestinationIP | String | The post-NAT destination IP address if destination NAT was performed. |
| Panorama.Monitor.Logs.NATDestinationPort | String | The post-NAT destination port. |
| Panorama.Monitor.Logs.NATSourceIP | String | The post-NAT source IP address if source NAT was performed. |
| Panorama.Monitor.Logs.NATSourcePort | String | The post-NAT source port. |
| Panorama.Monitor.Logs.PCAPid | String | The packet capture (pcap) ID is a 64 bit unsigned integral denoting
an ID to correlate threat pcap files with extended pcaps taken as a part of
that flow. All threat logs will contain either a pcap_id of 0 (no associated
pcap), or an ID referencing the extended pcap file. |
| Panorama.Monitor.Logs.IPProtocol | String | The IP protocol associated with the session. |
| Panorama.Monitor.Logs.Recipient | String | Only for the WildFire subtype, all other types do not use this field.
Specifies the name of the receiver of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall. |
| Panorama.Monitor.Logs.Rule | String | The name of the rule that the session matched. |
| Panorama.Monitor.Logs.RuleID | String | The ID of the rule that the session matched. |
| Panorama.Monitor.Logs.ReceiveTime | String | The time the log was received at the management plane. |
| Panorama.Monitor.Logs.Sender | String | Only for the WildFire subtype; all other types do not use this field.
Specifies the name of the sender of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall. |
| Panorama.Monitor.Logs.SessionID | String | An internal numerical identifier applied to each session. |
| Panorama.Monitor.Logs.DeviceSN | String | The serial number of the firewall on which the session was logged. |
| Panorama.Monitor.Logs.Severity | String | The severity associated with the threat. Can be “informational”, “low”,
“medium”, “high”, or “critical”. |
| Panorama.Monitor.Logs.SourceAddress | String | The original session source IP address. |
| Panorama.Monitor.Logs.SourceCountry | String | The source country or internal region for private addresses. Maximum
length is 32 bytes. |
| Panorama.Monitor.Logs.SourceUser | String | The username of the user who initiated the session. |
| Panorama.Monitor.Logs.SourcePort | String | The source port utilized by the session. |
| Panorama.Monitor.Logs.ThreatCategory | String | The threat categories used to classify different types of
threat signatures. |
| Panorama.Monitor.Logs.Name | String | The Palo Alto Networks identifier for the threat. A description
string followed by a 64-bit numerical identifier. |
| Panorama.Monitor.Logs.ID | String | The Palo Alto Networks ID for the threat. |
| Panorama.Monitor.Logs.ToZone | String | The zone to which the session was destined. |
| Panorama.Monitor.Logs.TimeGenerated | String | The time the log was generated on the data plane. |
| Panorama.Monitor.Logs.URLCategoryList | String | A list of the URL filtering categories the firewall used to
enforce the policy. |
| Panorama.Monitor.Logs.Bytes | String | The total log bytes. |
| Panorama.Monitor.Logs.BytesReceived | String | The log bytes received. |
| Panorama.Monitor.Logs.BytesSent | String | The log bytes sent. |
| Panorama.Monitor.Logs.Vsys | String | The VSYS on the firewall that generated the log. |

Command example with polling

!pan-os-query-logs log-type=traffic number_of_logs=1 polling=true show-detail=yes

Context example

{
    "Panorama": {
        "Monitor": {
            "JobID": "1291",
            "LogType": "traffic",
            "Logs": {
              "TimeGenerated": "2019/07/24 08:50:24",
              "SourceAddress": "1.1.1.1",
              "DestinationAddress": "2.3.4.5",
              "Application": "web-browsing",
              "Action": "deny",
              "Rule": "any - any accept"
            },
            "Status": "Completed"
        }
    }
}

Human Readable Output

Fetching traffic logs for job ID 1291…

Query traffic Logs

TimeGenerated	SourceAddress	DestinationAddress	Application	Action	Rule
2019/07/24 08:50:24	1.1.1.1	2.3.4.5	web-browsing	deny	any - any accept

Command example without polling

!pan-os-query-logs log-type=traffic number_of_logs=1

Context Example

{
    "Panorama": {
        "Monitor": {
            "JobID": "1283",
            "LogType": "traffic",
            "Message": "query job enqueued with jobid 1283",
            "Status": "Pending"
        }
    }
}

Human Readable Output

Query Logs

JobID	Status
1283	Pending

pan-os-check-logs-status

Checks the status of a logs query.

Base Command

pan-os-check-logs-status

Input

Context Output

Command Example

!pan-os-check-logs-status job_id=657

Human Readable Output

Query Logs Status

JobID	Status
657	Completed

pan-os-get-logs

Retrieves the data of a logs query.

Base Command

pan-os-get-logs

Input

Context Output

Command Example

!pan-os-get-logs job_id=678

Human Readable Output

Query data Logs

TimeGenerated	SourceAddress	DestinationAddress	Application	Action	Rule
2019/07/24 08:50:24	1.1.1.1	2.3.4.5	web-browsing	deny	any - any accept

pan-os-security-policy-match

Checks whether a session matches a specified security policy. This command is only available on Firewall instances.

Base Command

pan-os-security-policy-match

Input