PAN-OS Log Forwarding Setup And Configuration

This playbook sets up and maintains log forwarding for the Panorama rulebase. It can be run when setting up a new instance, or as a periodic job to enforce log forwarding policy. You can either update all rules and override previous profiles, or update only rules that do not have a log forwarding profile configured.

PAN-OS by Palo Alto Networks · 11 tasks · 5 inputs · 0 outputs

Details

ID	`PAN-OS Log Forwarding Setup And Configuration`
From Version	5.0.0
Tasks	11

README

Sets up and maintains log forwarding for the Panorama rulebase.
It can be run when setting up a new instance, or as a periodic job to enforce log forwarding policy.
You can either update all rules and override previous profiles, or update only rules that do not have a log forwarding profile configured.

Description & Playbook Flow

The playbook lists all of the rules (either pre-rulebase or post-rulebase).
If the analyst wishes to override the log-forwarding profile for all rules, it updates all the rules with the given profile.
If the analyst wishes to update only rules with missing profiles, it will update only those rules.
In the end, the playbook will commit to PAN-OS (either auto-commit or manual commit by the analyst).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

PAN-OS Commit Configuration

Integrations

Palo Alto Networks PAN-OS

Scripts

Set
AreValuesEqual

Commands

pan-os-edit-rule
pan-os-list-rules

Playbook Inputs

Name	Description	Default Value	Required
log-forwarding-name	The name of the log-forwarding object that will be attached to all of the rules.	log_forwarding_101	Required
auto_commit	Whether the rule should be committed automatically or manually.	yes	Optional
pre-post-rulebase	Either the pre-rulebase or post-rulebase, depending on the rule structure.	pre-rulebase	Required
device-group	The device group to work on.	-	Optional
override-existing-profiles	Whether the log-forwarding profiles that were already defined should be overrode.	False	Optional

Playbook Outputs

There are no outputs for this playbook.

Known Limitations

The log forwarding profile needs to be configured manually and provided to this playbook as an input. link
In the future, we’ll support auto-creation of Cortex Data Lake log forwarding profiles.

Playbook Image

PAN-OS_Log_Forwarding_Setup_And_Maintenance

Inputs

log-forwarding-name — The name of the log-forwarding object that will be attached to all of the rules.
auto_commit — Should the rule be committed automatically or manually?
pre-post-rulebase — Either the pre-rulebase or post-rulebase, depending on the rule structure.
device-group — The device group to work on.
override-existing-profiles — Should we override log-forwarding profiles that were already defined.

Commands used

pan-os-edit-rule pan-os-list-rules

Flowchart

Source

playbook-PAN-OS_Log_Forwarding_Setup_And_Maintenance.yml

Download History Raw

id: PAN-OS Log Forwarding Setup And Configuration
version: -1
name: PAN-OS Log Forwarding Setup And Configuration
fromversion: 5.0.0
description: |-
  This playbook sets up and maintains log forwarding for the Panorama rulebase.
  It can be run when setting up a new instance, or as a periodic job to enforce log forwarding policy.
  You can either update all rules and override previous profiles, or update only rules that do not have a log forwarding profile configured.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 7e873ae1-3b70-44c6-88c7-02412b36edd8
    type: start
    task:
      id: 7e873ae1-3b70-44c6-88c7-02412b36edd8
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: ba687fe6-5fca-47ea-8e06-96b6a46c74ed
    type: title
    task:
      id: ba687fe6-5fca-47ea-8e06-96b6a46c74ed
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 600,
          "y": 2150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: dcfda5d3-0a33-4de2-82b3-5561281dce01
    type: regular
    task:
      id: dcfda5d3-0a33-4de2-82b3-5561281dce01
      version: -1
      name: List Rules
      description: "List all rules"
      script: '|||pan-os-list-rules'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      device-group:
        simple: ${inputs.device-group}
      pre_post:
        simple: ${inputs.pre-post-rulebase}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 5b2f24d9-17a1-4c77-815a-d790c0e48565
    type: regular
    task:
      id: 5b2f24d9-17a1-4c77-815a-d790c0e48565
      version: -1
      name: 'Add log forwarding profile to all rules '
      description: Edit the rule and add a log forwarding profile. This overrides existing profiles.
      script: '|||pan-os-edit-rule'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      element_to_change:
        simple: log-forwarding
      element_value:
        simple: ${inputs.log-forwarding-name}
      pre_post:
        simple: ${inputs.pre-post-rulebase}
      rulename:
        complex:
          root: Panorama
          accessor: SecurityRule.Name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -60,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 382555b7-9ed7-483b-8545-d81f4ecb7e2e
    type: condition
    task:
      id: 382555b7-9ed7-483b-8545-d81f4ecb7e2e
      version: -1
      name: Is auto-commit defined?
      description: Check whether the values provided in arguments are equal. If either of the arguments is missing, the value "no" is returned.
      scriptName: AreValuesEqual
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "6"
      "yes":
      - "7"
    scriptarguments:
      left:
        simple: ${inputs.auto_commit}
      right:
        simple: "yes"
    results:
    - AreValuesEqual
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: 1c1fc4c9-32a2-4caa-8030-b9d6732f4eeb
    type: regular
    task:
      id: 1c1fc4c9-32a2-4caa-8030-b9d6732f4eeb
      version: -1
      name: Manually commit
      description: Allows the analyst to manually commit the changes. This is available if auto-commit is "false".
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 190,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: e1ad0e46-d6b0-4536-89ff-4c06849e515e
    type: playbook
    task:
      id: e1ad0e46-d6b0-4536-89ff-4c06849e515e
      version: -1
      name: PAN-OS Commit Configuration
      description: ""
      playbookName: PAN-OS Commit Configuration
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": -290,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: bfb7bb7b-a03d-4295-8160-8932a31ae6ac
    type: condition
    task:
      id: bfb7bb7b-a03d-4295-8160-8932a31ae6ac
      version: -1
      name: 'Should we override existing log forwarding profile?'
      description: Check if we should override existing profiles, or only update rules with no profile defined.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.override-existing-profiles
            iscontext: true
          right:
            value:
              simple: "True"
    view: |-
      {
        "position": {
          "x": 265,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: cd2c1788-157f-439f-8995-9f86101940bf
    type: regular
    task:
      id: cd2c1788-157f-439f-8995-9f86101940bf
      version: -1
      name: Add log forwarding profile to rules that don't have it
      description: Edit the rule and add a log forwarding profile. Update only rules that don't have a profile already defined.
      script: '|||pan-os-edit-rule'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      element_to_change:
        simple: log-forwarding
      element_value:
        simple: ${inputs.log-forwarding-name}
      pre_post:
        simple: ${inputs.pre-post-rulebase}
      rulename:
        complex:
          root: PanoramaSecurityRule
          filters:
          - - operator: isNotExists
              left:
                value:
                  simple: PanoramaSecurityRule.LogForwardingProfile
                iscontext: true
          accessor: Name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 360,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: ebac79c1-c50d-4321-89fd-f0ba3b115ac2
    type: regular
    task:
      id: ebac79c1-c50d-4321-89fd-f0ba3b115ac2
      version: -1
      name: Set security rules to context
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      append: {}
      key:
        simple: PanoramaSecurityRule
      value:
        simple: ${Panorama.SecurityRule}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 600,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: b3db37d3-7b79-42f6-893c-a5ced31a7872
    type: condition
    task:
      id: b3db37d3-7b79-42f6-893c-a5ced31a7872
      version: -1
      name: Are there rules without a log forwarding profile configured?
      description: Checks if there are rules that have no log forwarding profile defined.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PanoramaSecurityRule
                filters:
                - - operator: isNotExists
                    left:
                      value:
                        simple: PanoramaSecurityRule.LogForwardingProfile
                      iscontext: true
                accessor: Name
            iscontext: true
    view: |-
      {
        "position": {
          "x": 600,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "12_10_yes": 0.31,
      "4_6_no": 0.76,
      "8_3_yes": 0.4
    },
    "paper": {
      "dimensions": {
        "height": 2165,
        "width": 1270,
        "x": -290,
        "y": 50
      }
    }
  }
inputs:
- key: log-forwarding-name
  value:
    simple: log_forwarding_101
  required: true
  description: The name of the log-forwarding object that will be attached to all of the rules.
- key: auto_commit
  value:
    simple: "yes"
  required: false
  description: Should the rule be committed automatically or manually?
- key: pre-post-rulebase
  value:
    simple: pre-rulebase
  required: true
  description: Either the pre-rulebase or post-rulebase, depending on the rule structure.
- key: device-group
  value: {}
  required: false
  description: The device group to work on.
- key: override-existing-profiles
  value:
    simple: "False"
  required: false
  description: Should we override log-forwarding profiles that were already defined.
outputs: []
tests:
- No Tests
supportedModules:
- agentix
- xsiam