PAN-OS create or edit policy

This playbook will automate the process of creating or editing a policy. The first task in the playbook checks if there is a security policy that matches the playbook inputs. If there is no security policy that matches, a new policy will be created. If there is a security policy that matches, the user will be able to modify the existing policy or create a new hardened policy.

Change Management · 19 tasks · 17 inputs · 0 outputs

Details

ID	`PAN-OS create or edit policy`
From Version	6.1.0
Tasks	19

README

This playbook will automate the process of creating or editing a policy.
The first task in the playbook checks whether there is a security policy that matches the playbook inputs. If there is no security policy that matches, a new policy will be created. If there is a security policy that matches, the user will be able to modify the existing policy or create a new hardened policy.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

PAN-OS Commit Configuration
PAN-OS edit policy

Integrations

This playbook does not use any integrations.

Scripts

PanoramaSecurityPolicyMatchWrapper
SetGridField

Commands

setIncident
panorama-create-rule

Playbook Inputs

Name	Description	Default Value	Required
Destination	Destination.	incident.destinationips	Optional
Source	Source.	incident.sourceips	Optional
Protocol	The IP protocol number	incident.protocol	Optional
Action	Action for the rule (allow, deny, drop)	incident.policyactions	Optional
Application	A comma-separated list of application object names for the rule to create.		Optional
Destination_zone	A comma-separated list of destination zones.	incident.destinationnetworks	Optional
Log_forwarding	Log forwarding profile.		Optional
Profile_setting	A profile setting group.		Optional
Rulename	Name of the rule to create.		Optional
Service	A comma-separated list of service object names for the rule.	incident.policyactions	Optional
Source_zone	A comma-separated list of source zones.	incident.sourcenetworks	Optional
Email	The email of the network/security team.		Optional
Rule_position	Pre rule or Post rule (Panorama instances). Possible options: - post-rulebase - pre-rulebase		Optional
Destination_port	Destination port.	incident.dstports	Optional
Target	Target number of the firewall. Use only for a Panorama instance.		Optional
Vsys	Target vsys of the firewall. Use only for a Panorama instance.		Optional
Limit	Maximum number of API requests that the PanoramaSecurityPolicyMatchWrapper script will send. The default is 500.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

PAN-OS create or edit policy

Inputs

Destination —
Source —
Protocol — The IP protocol number
Action — Action for the rule (allow, deny, drop)
Application — A comma-separated list of application object names for the rule to create.
Destination_zone — A comma-separated list of destination zones.
Log_forwarding — Log forwarding profile.
Profile_setting — A profile setting group.
Rulename — Name of the rule to create.
Service — A comma-separated list of service object names for the rule.
Source_zone — A comma-separated list of source zones.
Email — The email of the network/security team.
Rule_position — Pre rule or Post rule (Panorama instances). Possible options: - post-rulebase - pre-rulebase
Destination_port —
Target — Target number of the firewall. Use only for a Panorama instance.
Vsys — Target vsys of the firewall. Use only for a Panorama instance.
Limit — Maximum number of API requests that the PanoramaSecurityPolicyMatchWrapper script will send. The default is 500.

Commands used

pan-os-create-rule setIncident

Flowchart

Source

playbook-PAN-OS_create_or_edit_policy.yml

Download History Raw

id: PAN-OS create or edit policy
version: -1
name: PAN-OS create or edit policy
description: "This playbook will automate the process of creating or editing a policy.\n\
  The first task in the playbook checks if there is a security policy that matches\
  \ the playbook inputs. If there is no security policy that matches, a new policy\
  \ will be created. If there is a security policy that matches, the user will be\
  \ able to modify the existing policy or create a new hardened policy."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9efb7cb0-9894-4aaf-8b35-4b3701f29f8b
    type: start
    task:
      id: 9efb7cb0-9894-4aaf-8b35-4b3701f29f8b
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": -545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 9b462c6e-8e91-4e39-8275-92c1b75e7155
    type: regular
    task:
      id: 9b462c6e-8e91-4e39-8275-92c1b75e7155
      version: -1
      name: Search for matching security policy?
      description: A wrapper script for the panorama-security-policy-match command
        that receives multiple values (array) in the DST, SRC, and port arguments
        and performs the policy match for each combination of the inputs.
      tags:
      - comment
      - comments
      scriptName: PanoramaSecurityPolicyMatchWrapper
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      application:
        complex:
          root: 'inputs.Application'
      destination:
        complex:
          root: inputs.Destination
      destination_port:
        complex:
          root: inputs.Destination_port
      execution-timeout:
        simple: "1000"
      from:
        complex:
          root: inputs.Source_zone
      limit:
        complex:
          root: inputs.Limit
      protocol:
        complex:
          root: 'inputs.Protocol'
      source:
        complex:
          root: inputs.Source
      target:
        complex:
          root: inputs.Target
      to:
        complex:
          root: inputs.Destination_zone
      vsys:
        complex:
          root: inputs.Vsys
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": -390
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: edbe7b28-b59d-41f8-895b-12310bf802ac
    type: condition
    task:
      id: edbe7b28-b59d-41f8-895b-12310bf802ac
      version: -1
      name: Is there matching security policy?
      description: Check if there is a matching security policy.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: Panorama.SecurityPolicyMatch.Rules.Name
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 380,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 98fc4b51-65cb-41a4-83d8-e29181344100
    type: collection
    task:
      id: 98fc4b51-65cb-41a4-83d8-e29181344100
      version: -1
      name: Edit existing rule
      description: Edits a policy rule.
      tags:
      - comment
      - comments
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      behaviour:
        simple: add
      element_to_change:
        simple: source
      element_value:
        complex:
          root: inputs.Source
      rulename:
        complex:
          root: Panorama.SecurityPolicyMatch.Rules
          accessor: Name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1170,
          "y": 1060
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${inputs.Email}
      subject:
        simple: Edit existing rule source
      body:
        simple: Edit existing rule source
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Which policy rule would you edit?
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - simple: ${Panorama.SecurityPolicyMatch.Rules.Name}
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Edit existing rule source
      description: Choose which rule to edit.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 138e8fde-74c5-4735-8672-6df6b5690263
    type: regular
    task:
      id: 138e8fde-74c5-4735-8672-6df6b5690263
      version: -1
      name: 'Create new rule '
      description: Creates a policy rule.
      tags:
      - comment
      - comments
      - work_notes
      script: '|||pan-os-create-rule'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      action:
        complex:
          root: inputs.Action
      application:
        complex:
          root: inputs.Application
      destination:
        complex:
          root: inputs.Destination
      destination_zone:
        complex:
          root: inputs.Destination_zone
      log_forwarding:
        complex:
          root: inputs.Log_forwarding
      pre_post:
        complex:
          root: inputs.Rule_position
      profile_setting:
        complex:
          root: inputs.Profile_setting
      rulename:
        complex:
          root: inputs.Rulename
      service:
        complex:
          root: inputs.Service
      source:
        complex:
          root: inputs.Source
      source_zone:
        complex:
          root: inputs.Source_zone
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -180,
          "y": 400
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: c5ee5c3a-8c06-4541-81f2-11fe7a7b1ae5
    type: title
    task:
      id: c5ee5c3a-8c06-4541-81f2-11fe7a7b1ae5
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: e02947f3-e874-46b5-8f27-34043e3c5e6e
    type: condition
    task:
      id: e02947f3-e874-46b5-8f27-34043e3c5e6e
      version: -1
      name: Ask if harden/modify the existing policy?
      description: Asking Whether to modify the current policy.
      tags:
      - comment
      - comments
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      'Don''t modify  ':
      - "8"
      'Modify  ':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 400
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${inputs.Email}
      subject:
        simple: Matching policy rule
      body:
        simple: |-
          Matching policy rule was found:
          ${Panorama.SecurityPolicyMatch.Rules.Name}
          Do you wish to harden/modify your existing policy with the new values that you provided?
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - 'Don''t modify  '
      - 'Modify  '
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 83a0a814-32d4-42fe-8fff-1680a8f9f261
    type: playbook
    task:
      id: 83a0a814-32d4-42fe-8fff-1680a8f9f261
      version: -1
      name: PAN-OS Commit Configuration
      description: Commit the PAN-OS/Panorama firewall configuration.\nIf specified
        as Panorama, it also pushes the policies to the specified device group in
        the instance.
      playbookName: PAN-OS Commit Configuration
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -180,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 5e1a775e-4a08-41fa-8554-200b99205450
    type: collection
    task:
      id: 5e1a775e-4a08-41fa-8554-200b99205450
      version: -1
      name: 'Create new rule or edit existing?'
      tags:
      - comment
      - comments
      type: collection
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1170,
          "y": 580
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${inputs.Email}
      subject:
        simple: Which action would you like to perform?
      body:
        simple: Do you want to create a new rule or edit an existing rule?
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - Create
      - Edit
      - 'Manually review the rule'
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: 'Add rule or modify existing rule?'
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - simple: Edit
        - simple: Create
        - simple: Manually review
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Which action would you like to perform?
      description: Choose one of the following actions.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: ff31debe-9458-4cdd-8177-23e53e0486ed
    type: regular
    task:
      id: ff31debe-9458-4cdd-8177-23e53e0486ed
      version: -1
      name: Create a new harden rule
      description: Creates a policy rule.
      tags:
      - comment
      - comments
      script: '|||pan-os-create-rule'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      action:
        simple: ${inputs.Action}
      application:
        complex:
          root: inputs.Application
      destination:
        complex:
          root: inputs.Destination
      destination_zone:
        complex:
          root: inputs.Destination_zone
      log_forwarding:
        complex:
          root: inputs.Log_forwarding
      pre_post:
        simple: ${inputs.Rule_position}
      profile_setting:
        complex:
          root: inputs.Profile_setting
      rulename:
        complex:
          root: inputs.Rulename
      service:
        complex:
          root: inputs.Service
      source:
        complex:
          root: inputs.Source
      source_zone:
        complex:
          root: inputs.Source_zone
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1610,
          "y": 1060
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 492abddf-ecbf-46b1-83a2-93fd2b381bcc
    type: playbook
    task:
      id: 492abddf-ecbf-46b1-83a2-93fd2b381bcc
      version: -1
      name: PAN-OS Commit Configuration
      playbookName: PAN-OS Commit Configuration
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1610,
          "y": 1500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: f88b18a8-85a1-448d-87eb-ba939766420d
    type: regular
    task:
      id: f88b18a8-85a1-448d-87eb-ba939766420d
      version: -1
      name: 'Manually review the relevant rule'
      description: Manually review the relevant rule in the firewall interface.
      tags:
      - comment
      - comments
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 7b5978e9-c78e-4308-8778-7657133f3cdf
    type: regular
    task:
      id: 7b5978e9-c78e-4308-8778-7657133f3cdf
      version: -1
      name: Set security policy match to layout
      description: Creates a grid table from items or key-value pairs.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      columns:
        simple: Name,Category,DeviceSerial,DeviceVsys,Destination,From,Source,To,Action
      context_path:
        simple: Panorama.SecurityPolicyMatch.Rules
      grid_id:
        simple: securitypolicymatch
      keys:
        simple: Name,Category,DeviceSerial,DeviceVsys,Destination,From,Source,To,Action
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 135
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 7f0fc9bf-2a76-4a98-8e43-3af4992dc6ed
    type: playbook
    task:
      id: 7f0fc9bf-2a76-4a98-8e43-3af4992dc6ed
      version: -1
      name: PAN-OS Commit Configuration
      description: Commit the PAN-OS/Panorama firewall configuration.\nIf specified
        as Panorama, it also pushes the policies to the specified device group in
        the instance.
      playbookName: PAN-OS Commit Configuration
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1170,
          "y": 1500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: e2ea7ec3-f0ca-4b1e-896c-fde413faa909
    type: regular
    task:
      id: e2ea7ec3-f0ca-4b1e-896c-fde413faa909
      version: -1
      name: Update incident state
      description: Set the incident state in the layout.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      state:
        simple: 4 - FW Policy Was Updated
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1170,
          "y": 1680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: c2935a67-b605-4686-85ca-8dee3378f0c7
    type: regular
    task:
      id: c2935a67-b605-4686-85ca-8dee3378f0c7
      version: -1
      name: Update incident state
      description: Set the incident state in the layout.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      state:
        simple: 4 - FW Policy Was Updated
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1610,
          "y": 1680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: b2f637e5-ee39-4ba5-845d-601d3a9eab21
    type: regular
    task:
      id: b2f637e5-ee39-4ba5-845d-601d3a9eab21
      version: -1
      name: Update incident state
      description: Set the incident state to the layout
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      state:
        simple: 4 - FW Policy Was Updated
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -180,
          "y": 975
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 44cfc485-17c2-4c51-8f0b-6f3092abafb9
    type: playbook
    task:
      id: 44cfc485-17c2-4c51-8f0b-6f3092abafb9
      version: -1
      name: PAN-OS edit policy
      description: This playbook will guide the user in the process of editing an
        existing policy. The playbook will send a data collection form that will retrieve
        the relevant parameters for editing the existing rule.
      playbookName: PAN-OS edit policy
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      SecurityTeamEmail:
        complex:
          root: inputs.Email
      rulename:
        complex:
          root: Edit existing rule source.Answers.0
          accessor: '[0]'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 1170,
          "y": 1270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: caab7b2f-7b00-4b13-81ef-407e21c4c29c
    type: condition
    task:
      id: caab7b2f-7b00-4b13-81ef-407e21c4c29c
      version: -1
      name: Which action was selected?
      tags:
      - comment
      - comments
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      Create:
      - "12"
      Edit:
      - "3"
      Manually review:
      - "14"
    separatecontext: false
    conditions:
    - label: Edit
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Which action would you like to perform?.Answers.0
            iscontext: true
          right:
            value:
              simple: Edit
    - label: Create
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Which action would you like to perform?.Answers.0
            iscontext: true
          right:
            value:
              simple: Create
    - label: Manually review
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Which action would you like to perform?.Answers.0
            iscontext: true
          right:
            value:
              simple: Manually review
    view: |-
      {
        "position": {
          "x": 1170,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "22_3_Edit": 0.63,
      "9_11_Modify  ": 0.44,
      "9_8_Don't modify  ": 0.4
    },
    "paper": {
      "dimensions": {
        "height": 2680,
        "width": 2170,
        "x": -180,
        "y": -545
      }
    }
  }
inputs:
- key: Destination
  value:
    complex:
      root: incident
      accessor: destinationips
  required: false
  description: ""
  playbookInputQuery:
- key: Source
  value:
    complex:
      root: incident
      accessor: sourceips
  required: false
  description: ""
  playbookInputQuery:
- key: 'Protocol'
  value:
    complex:
      root: incident
      accessor: protocol
  required: false
  description: The IP protocol number
  playbookInputQuery:
- key: Action
  value:
    complex:
      root: incident
      accessor: policyactions
  required: false
  description: Action for the rule (allow, deny, drop)
  playbookInputQuery:
- key: 'Application '
  value: {}
  required: false
  description: A comma-separated list of application object names for the rule to
    create.
  playbookInputQuery:
- key: Destination_zone
  value:
    complex:
      root: incident
      accessor: destinationnetworks
  required: false
  description: A comma-separated list of destination zones.
  playbookInputQuery:
- key: Log_forwarding
  value: {}
  required: false
  description: Log forwarding profile.
  playbookInputQuery:
- key: Profile_setting
  value: {}
  required: false
  description: A profile setting group.
  playbookInputQuery:
- key: Rulename
  value: {}
  required: false
  description: Name of the rule to create.
  playbookInputQuery:
- key: Service
  value:
    complex:
      root: incident
      accessor: policyactions
  required: false
  description: A comma-separated list of service object names for the rule.
  playbookInputQuery:
- key: Source_zone
  value:
    complex:
      root: incident
      accessor: sourcenetworks
  required: false
  description: A comma-separated list of source zones.
  playbookInputQuery:
- key: Email
  value: {}
  required: false
  description: 'The email of the network/security team.'
  playbookInputQuery:
- key: Rule_position
  value: {}
  required: false
  description: |-
    Pre rule or Post rule (Panorama instances).
    Possible options:
    - post-rulebase
    - pre-rulebase
  playbookInputQuery:
- key: Destination_port
  value:
    complex:
      root: incident
      accessor: dstports
  required: false
  description: ""
  playbookInputQuery:
- key: Target
  value: {}
  required: false
  description: Target number of the firewall. Use only for a Panorama instance.
  playbookInputQuery:
- key: Vsys
  value: {}
  required: false
  description: Target vsys of the firewall. Use only for a Panorama instance.
  playbookInputQuery:
- key: Limit
  value: {}
  required: false
  description: "Maximum number of API requests that the \nPanoramaSecurityPolicyMatchWrapper\
    \ script will send.\nThe default is 500."
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.1.0