Prisma SASE - Create a security pre-rule for EDL

This playbook helps to create a security rule to block indicators from an EDL. This playbook should run only once to setup the EDL object and its rule.

Palo Alto Networks - Strata Cloud Manager · 10 tasks · 9 inputs · 32 outputs

Inputs

  • TSGID — Tenant services group ID. If not provided, the tsg_id integration parameter will be used as the default.
  • Folder — The configuration folder group setting. The default value is 'Shared'.
  • URL — The source URL for the External Dynamic List. If the chosen type is ip/url/domain, this value must be provided.
  • EDLObjectName — The external dynamic list object name.
  • RuleName — The Security Policy Rule name will be created for blocking the indicators.
  • EDLObjectType — Possible values (Choose only 1): domain,ip,url,predefined_ip,predefined_url
  • AutoCommit — Possible Values: True -> Will commit and push configuration. False -> Manual push will be required. Else --> Will ignore the push section and continue the playbook.
  • IPListName — The predefined IP list. If the type is predefined_ip, a value must be provided. Possible values: panw-bulletproof-ip-list,panw-highrisk-ip-list,panw-known-ip-list,panw-torexit-ip-list.
  • URLListName — The predefined URL list. If the type is predefined_url, a value must be provided. Possible value: panw–auth-portal-exclude-list

Outputs

  • PrismaSase.CandidateConfig — Configuration job object.
  • PrismaSase.CandidateConfig.job_id — Configuration job ID.
  • PrismaSase.CandidateConfig.result — The configuration push result, e.g. OK, FAIL.
  • PrismaSase.CandidateConfig.details — The configuration push details.
  • PrismaSase.ExternalDynamicList — The external dynamic list object.
  • PrismaSase.ExternalDynamicList.id — The external dynamic list ID.
  • PrismaSase.ExternalDynamicList.name — The external dynamic list name.
  • PrismaSase.ExternalDynamicList.folder — The external dynamic list folder.
  • PrismaSase.ExternalDynamicList.description — The external dynamic list description.
  • PrismaSase.ExternalDynamicList.type — The external dynamic list type.
  • PrismaSase.ExternalDynamicList.source — The external dynamic list source.
  • PrismaSase.ExternalDynamicList.frequency — The external dynamic list frequency.
  • PrismaSase — The root context key for Prisma SASE integration output.
  • PrismaSase.SecurityRule — Found security rule.
  • PrismaSase.SecurityRule.action — Security rule action.
  • PrismaSase.SecurityRule.application — Security rule application.
  • PrismaSase.SecurityRule.category — Security rule category.
  • PrismaSase.SecurityRule.description — Security rule description.
  • PrismaSase.SecurityRule.destination — Security rule destination.
  • PrismaSase.SecurityRule.folder — Security rule folder.
  • PrismaSase.SecurityRule.from — Security rule from field (source zone(s)).
  • PrismaSase.SecurityRule.id — Security rule ID.
  • PrismaSase.SecurityRule.log_setting — Security rule log setting.
  • PrismaSase.SecurityRule.name — Security rule name.
  • PrismaSase.SecurityRule.position — Security rule position.
  • PrismaSase.SecurityRule.service — Security rule service.
  • PrismaSase.SecurityRule.source — Security rule source.
  • PrismaSase.SecurityRule.source_user — Security rule source user.
  • PrismaSase.SecurityRule.to — Security rule to field (destination zone(s)).
  • PrismaSase.SecurityRule.negate_destination — Security rule negate destination.
  • PrismaSase.SecurityRule.profile_setting — The Security rule group object in the rule.
  • PrismaSase.SecurityRule.profile_setting.group — Security rule group.

Commands used

prisma-sase-candidate-config-push prisma-sase-external-dynamic-list-list

Flowchart

Auto Commit Manual Create New Object EDL Object Exist yes Push Start Start Push Config - prisma-sase-candidate-config-push Push Config prisma-sase-candidate-config-... Commit and push configuration to folders? Commit and push configura... Done Done Check if the source URL was provided and check if a EDL object was specified. Check if the source URL w... Get EDL object - prisma-sase-external-dynamic-list-list Get EDL object prisma-sase-external-dynamic-... Was there a returned object? Was there a returned object? Prisma SASE - Create or Edit EDL object - Prisma SASE - Create or Edit EDL object Prisma SASE - Create or E... Prisma SASE - Create or Edit ... Prisma SASE - Create or Edit Security Policy Rule - Prisma SASE - Create or Edit Security Policy Rule Prisma SASE - Create or E... Prisma SASE - Create or Edit ... Choose to commit and push configuration automatically Choose to commit and push...