Palo Alto Networks - Prisma SASE

Provides commands for interaction with Prisma SASE API.
This integration was integrated and tested with version v1 of Palo Alto Networks - Prisma SASE

Configure Palo Alto Networks - Strata Cloud Manager in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

prisma-sase-security-rule-create

Create a new security rule.

Base Command

prisma-sase-security-rule-create

Input

Context Output

Command example

!prisma-sase-security-rule-create name="somename11" action="allow"

Context Example

{
    "PrismaSase": {
        "SecurityRule": {
            "action": "allow",
            "application": [
                "any"
            ],
            "category": [
                "any"
            ],
            "destination": [
                "any"
            ],
            "folder": "Shared",
            "from": [
                "any"
            ],
            "id": "Id",
            "name": "somename11",
            "position": "pre",
            "service": [
                "any"
            ],
            "source": [
                "any"
            ],
            "source_user": [
                "any"
            ],
            "to": [
                "any"
            ]
        }
    }
}

Human Readable Output

Security Rule Created

Action	Application	Category	Destination	Folder	From	Id	Name	Position	Service	Source	Source User	To
allow	any	any	any	Shared	any	Id	somename11	pre	any	any	any	any

prisma-sase-security-rule-list

Lists all security rules.

Base Command

prisma-sase-security-rule-list

Input

Context Output

Command example

!prisma-sase-security-rule-list limit=1

Context Example

{
    "PrismaSase": {
        "SecurityRule": {
            "action": "drop",
            "application": [
                "any"
            ],
            "category": [
                "any"
            ],
            "description": "Rule to block",
            "destination": [
                "panw-highrisk-ip-list"
            ],
            "folder": "Shared",
            "from": [
                "any"
            ],
            "id": "Id",
            "log_setting": "Cortex Data Lake",
            "name": "name",
            "negate_destination": false,
            "position": "pre",
            "service": [
                "any"
            ],
            "source": [
                "any"
            ],
            "source_user": [
                "any"
            ],
            "tag": [
                "best-practice"
            ],
            "to": [
                "any"
            ]
        }
    }
}

Human Readable Output

Security Rules

Id	Name	Description	Action	Destination	Folder
Id	Name	Rule to block	drop	panw-highrisk-ip-list	Shared

prisma-sase-candidate-config-push

Push the candidate configuration.

Base Command

prisma-sase-candidate-config-push

Input

Context Output

Command example

!prisma-sase-candidate-config-push folders="Mobile Users"

Human Readable Output

Waiting for all data to push for job id 201

prisma-sase-security-rule-update

Update an existing security rule.

Base Command

prisma-sase-security-rule-update

Input

Context Output

Command example

!prisma-sase-security-rule-update rule_id="Id" position="pre" action="deny"

Context Example

{
    "PrismaSase": {
        "SecurityRule": {
            "action": "deny",
            "application": [
                "any"
            ],
            "category": [
                "test"
            ],
            "description": "test",
            "destination": [
                "any"
            ],
            "folder": "Shared",
            "from": [
                "any"
            ],
            "id": "Id",
            "name": "somename",
            "position": "pre",
            "service": [
                "any"
            ],
            "source": [
                "any"
            ],
            "source_user": [
                "any"
            ],
            "to": [
                "any"
            ]
        }
    }
}

Human Readable Output

Security Rule Updated

Action	Application	Category	Description	Destination	Folder	From	Id	Name	Position	Service	Source	Source User	To
deny	any	test	test	any	Shared	any	Id	name	pre	any	any	any	any

prisma-sase-address-object-update

Update an existing address object.

Base Command

prisma-sase-address-object-update

Input

Context Output

Command example

!prisma-sase-address-object-update object_id="Id" address_value="8.8.8.4/32"

Context Example

{
    "PrismaSase": {
        "Address": {
            "address_value": "8.8.8.4/32",
            "folder": "Shared",
            "id": "Id",
            "name": "name",
            "type": "ip_netmask"
        }
    }
}

Human Readable Output

Address Object updated

Address Value	Folder	Id	Name	Type
8.8.8.4/32	Shared	Id	name	ip_netmask

prisma-sase-config-job-list

Lists all configuration jobs.

Base Command

prisma-sase-config-job-list

Input

Context Output

prisma-sase-security-rule-delete

Delete a specific security rule.

Base Command

prisma-sase-security-rule-delete

Input

Context Output

There is no context output for this command.

Command example

!prisma-sase-security-rule-delete rule_id="Id"

Human Readable Output

Security Rule object with id Id and name name was deleted successfully

prisma-sase-address-object-create

Create a new address object.

Base Command

prisma-sase-address-object-create

Input

Context Output

Command example

!prisma-sase-address-object-create name="somename11" type="ip_netmask" address_value="8.8.8.8/32"

Context Example

{
    "PrismaSase": {
        "Address": {
            "address_value": "8.8.8.8/32",
            "folder": "Shared",
            "id": "id",
            "name": "somename11",
            "type": "ip_netmask"
        }
    }
}

Human Readable Output

Address Object Created

Address Value	Folder	Id	Name	Type
8.8.8.8/32	Shared	Id	somename11	ip_netmask

prisma-sase-address-object-delete

Delete a specific address object.

Base Command

prisma-sase-address-object-delete

Input

Context Output

There is no context output for this command.

Command example

!prisma-sase-address-object-delete object_id="Id"

Human Readable Output

Address object with id Id and name name was deleted successfully

prisma-sase-address-object-list

Lists all addresses objects.

Base Command

prisma-sase-address-object-list

Input

Context Output

Command example

!prisma-sase-address-object-list limit=1

Context Example

{
    "PrismaSase": {
        "Address": {
            "address_value": "test.com",
            "description": "description",
            "folder": "Shared",
            "id": "Id",
            "name": "name",
            "type": "fqdn"
        }
    }
}

Human Readable Output

Address Objects

Id	Name	Description	Type	Address Value	Tag
Id	Palo Alto Networks Sinkhole	Palo Alto Networks	fqdn	test.com

prisma-sase-tag-list

Lists all tags.

Base Command

prisma-sase-tag-list

Input

Context Output

Command example

!prisma-sase-tag-list limit=1

Context Example

{
    "PrismaSase": {
        "Tag": {
            "color": "Olive",
            "folder": "predefined",
            "name": "Sanctioned"
        }
    }
}

Human Readable Output

Tags

Id	Name	Folder	Color	Comments
Id	test	predefined	Olive

prisma-sase-tag-create

Create a new tag.

Base Command

prisma-sase-tag-create

Input

Context Output

Command example

!prisma-sase-tag-create name="somename11" color="Azure Blue"

Context Example

{
    "PrismaSase": {
        "Tag": {
            "color": "Azure Blue",
            "folder": "Shared",
            "id": "Id",
            "name": "somename11"
        }
    }
}

Human Readable Output

Address Object Created

Color	Folder	Id	Name
Azure Blue	Shared	Id	somename11

prisma-sase-tag-update

Update an existing tag.

Base Command

prisma-sase-tag-update

Input

Context Output

Command example

!prisma-sase-tag-update tag_id="Id" color="Black"

Context Example

{
    "PrismaSase": {
        "Tag": {
            "color": "Black",
            "folder": "Shared",
            "id": "Id",
            "name": "somename"
        }
    }
}

Human Readable Output

Tag Edited

Color	Folder	Id	Name
Black	Shared	Id	somename

prisma-sase-tag-delete

Delete a specific tag.

Base Command

prisma-sase-tag-delete

Input

Context Output

There is no context output for this command.

Command example

!prisma-sase-tag-delete tag_id="Id"

Human Readable Output

Tag with id Id and name somename was deleted successfully

prisma-sase-address-group-list

Lists all address groups.

Base Command

prisma-sase-address-group-list

Input

Context Output

Command example

!prisma-sase-address-group-list limit=1

Context Example

{
    "PrismaSase": {
        "AddressGroup": {
            "description": "test",
            "dynamic_filter": "'test' or 'test1' and 'best-practice'",
            "folder": "Shared",
            "id": "Id",
            "name": "Test"
        }
    }
}

Human Readable Output

Address Groups

Id	Name	Description	Addresses	Dynamic Filter
Id	Moishy_Test	test		‘test’ or ‘test1’ and ‘best-practice’

prisma-sase-address-group-create

Create a new address group.

Base Command

prisma-sase-address-group-create

Input

Context Output

Command example

!prisma-sase-address-group-create name="somename" dynamic_filter="test" overwrite="false"

Context Example

{
    "PrismaSase": {
        "AddressGroup": {
            "dynamic_filter": "test",
            "folder": "Shared",
            "id": "Id",
            "name": "somename"
        }
    }
}

Human Readable Output

Address Group created

Dynamic Filter	Folder	Id	Name
test	Shared	Id	somename

prisma-sase-address-group-update

Update an existing address group.

Base Command

prisma-sase-address-group-update

Input

Context Output

Command example

!prisma-sase-address-group-update group_id="Id" dynamic_filter="and 'test2'" overwrite="false"

Context Example

{
    "PrismaSase": {
        "AddressGroup": {
            "dynamic_filter": "test and test2",
            "folder": "Shared",
            "id": "Id",
            "name": "somename"
        }
    }
}

Human Readable Output

Address Group updated

Dynamic Filter	Folder	Id	Name
test and test2	Shared	Id	somename

prisma-sase-address-group-delete

Delete a specific address group.

Base Command

prisma-sase-address-group-delete

Input

Context Output

There is no context output for this command.

Command example

!prisma-sase-address-group-delete group_id="Id"

Human Readable Output

Address group with id Id and name somename was deleted successfully

prisma-sase-custom-url-category-list

Lists all custom URL categories.

Base Command

prisma-sase-custom-url-category-list

Input

Context Output

Command example

!prisma-sase-custom-url-category-list limit=1

Context Example

{
    "PrismaSase": {
        "CustomURLCategory": {
            "folder": "Shared",
            "id": "Id",
            "list": [
                "www.test.com",
                "www.test2.com"
            ],
            "name": "name",
            "type": "URL List"
        }
    }
}

Human Readable Output

Custom Url Categories

Id	Name	Folder	Type	List
Id	name	Shared	URL List	www.test2.com, www.test.com

prisma-sase-custom-url-category-create

Create a new URL category.

Base Command

prisma-sase-custom-url-category-create

Input

Context Output

Command example

!prisma-sase-custom-url-category-create type="Category Match" value="low-risk" name="somename11"

Context Example

{
    "PrismaSase": {
        "CustomURLCategory": {
            "folder": "Shared",
            "id": "id",
            "list": [
                "low-risk"
            ],
            "name": "somename11",
            "type": "Category Match"
        }
    }
}

Human Readable Output

Custom URrl Category Created

Folder	Id	List	Name	Type
Shared	Id	low-risk	somename11	Category Match

prisma-sase-custom-url-category-update

Update an existing url category.

Base Command

prisma-sase-custom-url-category-update

Input

Context Output

Command example

!prisma-sase-custom-url-category-update id="Id" value="high-risk" overwrite="false"

Context Example

{
    "PrismaSase": {
        "CustomURLCategory": {
            "folder": "Shared",
            "id": "Id",
            "list": [
                "low-risk",
                "high-risk"
            ],
            "name": "somename",
            "type": "Category Match"
        }
    }
}

Human Readable Output

Custom Url Category updated

Folder	Id	List	Name	Type
Shared	Id	low-risk, high-risk	somename	Category Match

prisma-sase-custom-url-category-delete

Delete a specific url category.

Base Command

prisma-sase-custom-url-category-delete

Input

Context Output

There is no context output for this command.

Command example

!prisma-sase-custom-url-category-delete id="Id"

Human Readable Output

Custom Url Category with id Id and name somename was deleted successfully

prisma-sase-external-dynamic-list-list

Lists all external dynamic lists.

Base Command

prisma-sase-external-dynamic-list-list

Input

Context Output

Command example

!prisma-sase-external-dynamic-list-list limit=1

Context Example

{
    "PrismaSase": {
        "ExternalDynamicList": {
            "description": "description",
            "display_name": "display name",
            "folder": "predefined",
            "name": "panw-known-ip-list",
            "source": "predefined",
            "type": "predefined"
        }
    }
}

Human Readable Output

External Dynamic Lists

Id	Name	Type	Folder	Description	Source	Frequency
	panw-known-ip-list	predefined	predefined	description	predefined

prisma-sase-external-dynamic-list-create

Create a new dynamic list.

Base Command

prisma-sase-external-dynamic-list-create

Input

Context Output

Command example

!prisma-sase-external-dynamic-list-create name="somename11" folder="Shared" type="predefined_ip" predefined_ip_list="panw-highrisk-ip-list"

Context Example

{
    "PrismaSase": {
        "ExternalDynamicList": {
            "description": null,
            "exception_list": null,
            "folder": "Shared",
            "frequency": null,
            "id": "Id",
            "name": "somename11",
            "source": "panw-highrisk-ip-list",
            "type": "predefined_ip"
        }
    }
}

Human Readable Output

External Dynamic List Created

Id	Name	Type	Folder	Description	Source	Frequency
Id	somename11	predefined_ip	Shared		panw-highrisk-ip-list

Command example

!prisma-sase-external-dynamic-list-create name="somename111" folder="Shared" type="domain" source_url="test.com" frequency="monthly" frequency_hour="09" day_of_month="1"

Context Example

{
    "PrismaSase": {
        "ExternalDynamicList": {
            "description": null,
            "exception_list": null,
            "folder": "Shared",
            "frequency": {
                "monthly": {
                    "at": "09",
                    "day_of_month": 1
                }
            },
            "id": "Id",
            "name": "somename111",
            "source": "test.com",
            "type": "domain"
        }
    }
}

Human Readable Output

External Dynamic List Created

Id	Name	Type	Folder	Description	Source	Frequency
Id	somename111	domain	Shared		test.com	monthly: at: 09 day_of_month: 1

prisma-sase-external-dynamic-list-update

Update an existing dynamic list.

Base Command

prisma-sase-external-dynamic-list-update

Input

Context Output

Command example

!prisma-sase-external-dynamic-list-update id'"Id"" predefined_ip_list="panw-lowrisk-ip-list"

Context Example

{
    "PrismaSase": {
        "ExternalDynamicList": {
            "description": null,
            "exception_list": null,
            "folder": "Shared",
            "frequency": null,
            "id": "Id",
            "name": "somename11",
            "source": "panw-lowrisk-ip-list",
            "type": "predefined_ip"
        }
    }
}

Human Readable Output

External Dynamic List Updated

Id	Name	Type	Folder	Description	Source	Frequency
Id	somename11	predefined_ip	Shared		panw-lowrisk-ip-list

prisma-sase-external-dynamic-list-delete

Delete a specific dynamic list.

Base Command

prisma-sase-external-dynamic-list-delete

Input

Context Output

There is no context output for this command.

Command example

!prisma-sase-external-dynamic-list-delete id="Id"

Human Readable Output

External Dynamic List with id Id and name name was deleted successfully

prisma-sase-url-category-list

Get all predefined URL categories.

Base Command

prisma-sase-url-category-list

Input

Context Output

There is no context output for this command.

Command example

!prisma-sase-url-category-list limit=1

Human Readable Output

URL categories

alert	allow	block	continue	override
recreation-and-hobbies, educational-institutions, real-estate, web-advertisements, health-and-medicine, stock-advice-and-tools, travel, computer-and-internet-info, personal-sites-and-blogs, swimsuits-and-intimate-apparel, social-networking, religion, medium-risk, business-and-economy, private-ip-addresses, web-hosting, entertainment-and-arts, streaming-media, abortion, translation, internet-portals, online-storage-and-backup, job-search, motor-vehicles, web-based-email, nudity, sports, training-and-tools, government, shareware-and-freeware, legal, shopping, alcohol-and-tobacco, low-risk, auctions, high-risk, search-engines, cryptocurrency, not-resolved, society, financial-services, military, news, philosophy-and-political-advocacy, content-delivery-networks, internet-communications-and-telephony, music, home-and-garden, hunting-and-fishing, reference-and-research, dating, sex-education, games		hacking, extremism, weapons, command-and-control, ransomware, copyright-infringement, dynamic-dns, parked, phishing, medium-risk, unknown, abused-drugs, insufficient-content, adult, newly-registered-domain, grayware, high-risk, gambling, malware, peer-to-peer, proxy-avoidance-and-anonymizers, questionable

prisma-sase-quarantine-host

Quarantine a host.

Base Command

prisma-sase-quarantine-host

Input

Context Output

There is no context output for this command.

Command example

!prisma-sase-quarantine-host host_id="host_id"

Human Readable Output

Host Quarantined

host_id
test_host

prisma-sase-cie-user-get

Get the CIE user.

Base Command

prisma-sase-cie-user-get

Input

Context Output