PanoramaSecurityPolicyMatchWrapper

Details

ID	`PanoramaSecurityPolicyMatchWrapper`
Language	python
From Version	6.1.0
Docker Image	`demisto/python3:3.12.13.10404775`

README

A wrapper script for the panorama-security-policy-match command that receives multiple values for the source, destination, and destination port arguments and performs the policy match for each combination of the inputs.

Script Data

Name	Description
Script Type	python3
Tags
Cortex XSOAR Version	6.1.0

Inputs

Argument Name	Description
application	The application name.
category	The category name.
destination	A comma-separated list of destination IP addresses.
from	The from zone.
to	The to zone.
protocol	The IP protocol value.
source	A comma-separated list of source IP addresses.
target	Target number of the firewall. Use only on a Panorama instance.
vsys	Target vsys of the firewall. Use only on a Panorama instance.
source_user	The source user.
destination_port	A comma-separated list of destination ports.
limit	Maximum number of API calls that script sends.

Outputs

Path	Description	Type
Panorama.SecurityPolicyMatch.Rules.Name	The matching rule name.	String
Panorama.SecurityPolicyMatch.Rules.Action	The matching rule action.	String
Panorama.SecurityPolicyMatch.Rules.Category	The matching rule category.	String
Panorama.SecurityPolicyMatch.Rules.Destination	The matching rule destination.	String
Panorama.SecurityPolicyMatch.Rules.From	The matching rule from zone.	String
Panorama.SecurityPolicyMatch.Rules.Source	The matching rule source.	String
Panorama.SecurityPolicyMatch.Rules.To	The matching rule to zone.	String

Script Examples

Example command

!PanoramaSecurityPolicyMatchWrapper destination=2.2.2.2 source=1.1.1.1,8.8.8.8 protocol=1

Context Example

{
    "Panorama": {
        "SecurityPolicyMatch": {
            "Rules": {
                "Action": "deny",
                "Category": "any",
                "Destination": "2.2.2.2",
                "From": "any",
                "Name": "test rule",
                "Source": "1.1.1.1",
                "To": "any"
            }
        }
    }
}

Human Readable Output

Matching Security Policies

Action Category Destination From Name Source To

deny any 2.2.2.2 any test rule 1.1.1.1 any

The query for source: 8.8.8.8, destination: 2.2.2.2 did not match a Security policy.

Action	Category	Destination	From	Name	Source	To
deny	any	2.2.2.2	any	test rule	1.1.1.1	any

Source

PanoramaSecurityPolicyMatchWrapper.py PanoramaSecurityPolicyMatchWrapper_test.py PanoramaSecurityPolicyMatchWrapper.yml

Download History Raw

SECURITY_POLICY_MATCH = [
    "The query for source: 2.2.2.2, destination: 8.8.8.8 did not match a Security policy.",
    "The query for source: 3.3.3.3, destination: 8.8.8.8 did not match a Security policy.",
    {
        "Action": "allow",
        "Category": "any",
        "Destination": "any",
        "DeviceSerial": "1234567890",
        "From": "any",
        "Name": "block rule",
        "Source": "1.1.1.1",
        "To": "any",
    },
]
SECURITY_POLICY_MATCH2 = ["The query for source: 1.1.1.1, destination: 8.8.8.8 did not match a Security policy."]


def test_fix_nested_dicts():
    from PanoramaSecurityPolicyMatchWrapper import fix_nested_dicts

    expected_result = {
        "Action": "drop",
        "Category": "alcohol-and-tobacco,hacking,abortion,adult",
        "Destination": "2.2.2.2,3.3.3.3",
        "From": "E,D",
        "Name": "block rule",
        "Source": "8.8.4.4,1.1.1.1,8.8.8.8",
        "To": "E,D",
    }
    rules = {
        "Action": "drop",
        "Category": "alcohol-and-tobacco,hacking,abortion,adult",
        "Destination": {"member": ["2.2.2.2", "3.3.3.3"]},
        "From": {"member": ["E", "D"]},
        "Name": "block rule",
        "Source": {"member": ["8.8.4.4", "1.1.1.1", "8.8.8.8"]},
        "To": {"member": ["E", "D"]},
    }
    fix_nested_dicts(rules)
    assert rules == expected_result


def test_wrapper_command(mocker):
    """
    Given:
        - args for wrapper_command
    When:
        - running PanoramaSecurityPolicyMatchWrapper command
    Then:
        - Validate the output returned as expected
    """
    from PanoramaSecurityPolicyMatchWrapper import wrapper_command

    args = {"destination": "8.8.8.8", "source": "1.1.1.1, 2.2.2.2, 3.3.3.3", "protocol": "4"}
    mocker.patch("PanoramaSecurityPolicyMatchWrapper.wrapper_panorama_security_policy_match", return_value=SECURITY_POLICY_MATCH)
    response = wrapper_command(args)

    assert response.outputs == [
        {
            "Action": "allow",
            "Category": "any",
            "Destination": "any",
            "DeviceSerial": "1234567890",
            "From": "any",
            "Name": "block rule",
            "Source": "1.1.1.1",
            "To": "any",
        }
    ]


def test_wrapper_panorama_security_policy_match(mocker):
    """
    Given:
        - args for wrapper_panorama_security_policy_match
    When:
        - calling wrapper_panorama_security_policy_match command
    Then:
        - Validate the output returned as expected
    """
    from PanoramaSecurityPolicyMatchWrapper import wrapper_panorama_security_policy_match

    args = {"protocol": "4"}
    mocker.patch("PanoramaSecurityPolicyMatchWrapper.panorama_security_policy_match", return_value=SECURITY_POLICY_MATCH2)
    response = wrapper_panorama_security_policy_match(["8.8.8.8"], ["1.1.1.1"], ["700"], args)

    assert response == SECURITY_POLICY_MATCH2