category: Network Security
provider: Palo Alto Networks
commonfields:
  id: PAN-OS Policy Optimizer
  version: -1
configuration:
- display: Server URL (e.g., https://192.168.0.1:443)
  name: server_url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- display: Vsys - Firewall instances only
  name: vsys
  type: 0
  required: false
- display: Device Group - Panorama instances only
  name: device_group
  type: 0
  required: false
- defaultvalue: '8'
  display: PAN-OS Version (The exact version, e.g., 10.1.4, 1.1, 9)
  name: version
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Automate your AppID Adoption by using this integration together with your Palo Alto Networks Next-Generation Firewall or Panorama.
display: PAN-OS Policy Optimizer (Beta)
name: PAN-OS Policy Optimizer
script:
  commands:
  - description: Gets the Policy Optimizer statistics.
    name: pan-os-po-get-stats
    arguments:
    - auto: PREDEFINED
      description: Whether to get pre-rules statistics or post-rules statistics. 'pre' for pre rules, 'post' for post-rules. Only for Panorama instances.
      name: position
      defaultValue: 'pre'
      predefined:
      - pre
      - post
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    outputs:
    - contextPath: PanOS.PolicyOptimizer.Stats.no_app_specified
      description: Number of rules with no apps specified.
      type: Number
    - contextPath: PanOS.PolicyOptimizer.Stats.unused
      description: Number of unused security policies.
      type: Number
    - contextPath: PanOS.PolicyOptimizer.Stats.unused_apps
      description: Number of unused apps in security policies.
      type: Number
    - contextPath: PanOS.PolicyOptimizer.Stats.unused_in_30_days
      description: Number of unused security policies in 30 days.
      type: Number
    - contextPath: PanOS.PolicyOptimizer.Stats.unused_in_90_days
      description: Number of unused security policies in 90 days.
      type: Number
  - description: Shows all security policies with no apps specified.
    name: pan-os-po-no-apps
    arguments:
    - auto: PREDEFINED
      description: Whether to get pre-rules with no apps or post-rules with no apps. 'pre' for pre rules, 'post' for post-rules. Only for Panorama instances.
      name: position
      defaultValue: 'pre'
      predefined:
      - pre
      - post
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    outputs:
    - contextPath: PanOS.PolicyOptimizer.NoApps
      description: Contains information about the rules that have no apps specified. For example, Source and Destination.
      type: Unknown
  - description: Gets the unused apps.
    name: pan-os-po-unused-apps
    arguments:
    - auto: PREDEFINED
      description: Whether to get pre-rules unused apps or post-rules unused apps. 'pre' for pre rules, 'post' for post-rules. Only for Panorama instances.
      name: position
      defaultValue: 'pre'
      predefined:
      - pre
      - post
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    outputs:
    - contextPath: PanOS.PolicyOptimizer.UnusedApps
      description: Shows all security rules with unused apps.
      type: String
  - arguments:
    - defaultValue: '30'
      description: The time frame in days to show the unused rules.
      name: timeframe
    - auto: PREDEFINED
      defaultValue: Unused
      description: Rule usage type to filter by. Can be Unused, Used, or Any.
      name: usage
      predefined:
      - Unused
      - Used
      - Any
    - defaultValue: 'false'
      description: Whether to exclude rules reset during the last x days, where x is the value defined in the timeframe argument. It will not exclude rules by default.
      name: exclude
      predefined:
      - 'false'
      - 'true'
      auto: PREDEFINED
    - auto: PREDEFINED
      description: Whether to get pre-rules, post-rules or both. 'pre' for pre rules, 'post' for post-rules, only for panorama instances.
      name: position
      defaultValue: 'both'
      predefined:
      - pre
      - post
      - both
    - defaultValue: security
      description: Which type of rules to query.
      name: rule_type
      predefined:
      - security
      - nat
      - qos
      - pbf
      - decryption
      - tunnel-inspect
      - application-override
      - authentication
      - dos
      - sdwan
      auto: PREDEFINED
    - defaultValue: '200'
      description: The maximum number of rules to return.
      name: limit
    - defaultValue: '200'
      description: The amount of items to return in each paginated call. Can only be a value of up to 200.
      name: page_size
    - description: A specific pagination page to get items from.
      name: page
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    description: Gets unused, used, or any rules.
    name: pan-os-po-get-rules
    outputs:
    - contextPath: PanOS.PolicyOptimizer.UnusedRules
      description: Shows all unused security rules.
      type: String
    - contextPath: PanOS.PolicyOptimizer.AnyRules
      description: Shows all security rules.
      type: String
    - contextPath: PanOS.PolicyOptimizer.UsedRules
      description: Shows all used security rules.
      type: String
  - arguments:
    - description: The UUID of the security rule.
      name: rule_uuid
      required: true
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    description: Gets the app usage statistics for a specific security rule.
    name: pan-os-po-app-and-usage
    outputs:
    - contextPath: PanOS.PolicyOptimizer.AppsAndUsage
      description: Shows detailed app usage statistics for specific security rules.
      type: Unknown
  - arguments:
    - description: Dynamic address group name.
      name: dag
      required: true
    - description: Query an alternate device group. Overrides the Device Group parameter.
      name: device_group
    description: Gets a specific dynamic address group.
    name: pan-os-get-dag
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: ''
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 6.0.0
beta: true