id: PAN-OS EDL Setup v3
version: -1
fromversion: 5.0.0
deprecated: true
hidden: true
name: PAN-OS EDL Setup v3
description: Deprecated. Use Generic Export Indicators Service instead.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 15be5abe-cd81-459e-8a8d-fd7b40bfe91d
    type: start
    task:
      id: 15be5abe-cd81-459e-8a8d-fd7b40bfe91d
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 255,\n    \"y\": 50\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '1':
    id: '1'
    taskid: 64be095d-1f01-4967-847f-5fc69d2b3400
    type: condition
    task:
      id: 64be095d-1f01-4967-847f-5fc69d2b3400
      version: -1
      name: Is PAN-OS integration enabled?
      description: Checks if there is an active instance of the PAN-OS integration enabled.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '3'
      yes:
      - '2'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Panorama
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": 255,\n    \"y\": 195\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '2':
    id: '2'
    taskid: 0e0a0837-5121-4762-8144-9b0c65eb4ad1
    type: condition
    task:
      id: 0e0a0837-5121-4762-8144-9b0c65eb4ad1
      version: -1
      name: Is PAN-OS EDL Management integration enabled?
      description: Checks if there is an active instance of the PAN-OS EDL Management integration enabled.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '3'
      yes:
      - '7'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: palo_alto_networks_pan_os_edl_management
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": 620,\n    \"y\": 370\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '3':
    id: '3'
    taskid: 42adb355-e0d8-4daf-808d-5a6c84d38e9e
    type: title
    task:
      id: 42adb355-e0d8-4daf-808d-5a6c84d38e9e
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 620,\n    \"y\": 2140\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '7':
    id: '7'
    taskid: 7ad2604a-f3e5-4bdf-803e-cc7d61dd3bf1
    type: regular
    task:
      id: 7ad2604a-f3e5-4bdf-803e-cc7d61dd3bf1
      version: -1
      name: Retrieve external file
      description: Extracts metadata for the external file from the web server.
      script: '|||pan-os-edl-get-external-file-metadata'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '18'
    scriptarguments:
      file_path:
        complex:
          root: inputs.list-name
          transformers:
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: .txt
    continueonerror: true
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1342.5,\n    \"y\": 540\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '16':
    id: '16'
    taskid: 2720f90b-4027-4694-8373-ffeff3461228
    type: regular
    task:
      id: 2720f90b-4027-4694-8373-ffeff3461228
      version: -1
      name: Add changes from external file to the internal list
      description: Fetches the content of the external file and merges it with the content of the internal list.
      script: '|||pan-os-edl-update-from-external-file'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '45'
    scriptarguments:
      file_path:
        simple: ${inputs.list-name}.txt
      list_name:
        simple: ${inputs.list-name}
      type:
        simple: merge
      verbose: {}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1710,\n    \"y\": 890\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '17':
    id: '17'
    taskid: f82881a1-c5ee-4903-800d-49ef69e5620b
    type: regular
    task:
      id: f82881a1-c5ee-4903-800d-49ef69e5620b
      version: -1
      name: Create internal list and external file
      description: Creates an internal list in Demisto and creates an external file on the web server.
      script: '|||pan-os-edl-update'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '19'
    scriptarguments:
      add_or_remove:
        simple: add
      file_path:
        simple: ${inputs.list-name}.txt
      list_items:
        simple: ${inputs.list-items}
      list_name:
        simple: ${inputs.list-name}
      verbose: {}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1060,\n    \"y\": 890\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '18':
    id: '18'
    taskid: ae1e3f95-b83b-4ac4-8980-1f51d4b132f0
    type: condition
    task:
      id: ae1e3f95-b83b-4ac4-8980-1f51d4b132f0
      version: -1
      name: Is there an external file?
      description: Checks if an external file exists on the web server.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '17'
      yes:
      - '16'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: PANOSEDL.FileName
            iscontext: true
          right:
            value:
              complex:
                root: inputs.list-name
                transformers:
                - operator: concat
                  args:
                    prefix: {}
                    suffix:
                      value:
                        simple: .txt
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": 1342.5,\n    \"y\": 720\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '19':
    id: '19'
    taskid: 9021dcf2-bcc7-432e-84aa-bcf740cc4c2b
    type: regular
    task:
      id: 9021dcf2-bcc7-432e-84aa-bcf740cc4c2b
      version: -1
      name: Create EDL Object
      description: Creates an external dynamic list in PAN-OS and connects it to the external file.
      script: '|||pan-os-create-edl'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '42'
    scriptarguments:
      certificate_profile: {}
      description: {}
      device-group:
        complex:
          root: inputs.device-group
      name:
        simple: ${inputs.list-name}-${inputs.ioc-type}-edl-object
      recurring:
        simple: five-minute
      type:
        simple: ${inputs.ioc-type}
      url:
        simple: ${inputs.web-server-url}${inputs.list-name}.txt
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1060,\n    \"y\": 1080\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '23':
    id: '23'
    taskid: a95785fa-5788-42cb-8339-8126d27af956
    type: condition
    task:
      id: a95785fa-5788-42cb-8339-8126d27af956
      version: -1
      name: Is auto-commit defined?
      description: Checks if the values provided in the arguments are equal. If either of the arguments are missing, "no" is returned.
      scriptName: AreValuesEqual
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      no:
      - '27'
      yes:
      - '48'
    scriptarguments:
      left:
        simple: ${inputs.auto-commit}
      right:
        simple: Yes
    results:
    - AreValuesEqual
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1060,\n    \"y\": 1800\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '27':
    id: '27'
    taskid: 7aa57715-2a37-449d-8213-cd6d546a647e
    type: regular
    task:
      id: 7aa57715-2a37-449d-8213-cd6d546a647e
      version: -1
      name: Manually commit
      description: Allows the analyst to manually commit the changes. This option is available when auto-commit is "false".
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1300,\n    \"y\": 1970\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '35':
    id: '35'
    taskid: beecfebc-ceaa-462b-81bd-3207a042ea6f
    type: regular
    task:
      id: beecfebc-ceaa-462b-81bd-3207a042ea6f
      version: -1
      name: Add the list items to the EDL
      description: Creates an internal list in Demisto and creates an external file on the web server.
      script: 'Panorama|||pan-os-edl-update'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '3'
    scriptarguments:
      add_or_remove:
        simple: add
      file_path:
        simple: ${inputs.list-name}.txt
      list_items:
        simple: ${inputs.list-items}
      list_name:
        simple: ${inputs.list-name}
      verbose: {}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1710,\n    \"y\": 1970\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '41':
    id: '41'
    taskid: 601988dc-5e76-46c1-8ba1-151df1df7578
    type: playbook
    task:
      id: 601988dc-5e76-46c1-8ba1-151df1df7578
      version: -1
      name: PAN-OS - Create Or Edit EDL Rule
      playbookName: PAN-OS - Create Or Edit EDL Rule
      type: playbook
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '23'
    scriptarguments:
      action-type:
        complex:
          root: inputs.action-type
      device-group:
        complex:
          root: inputs.device-group
      element-to-add:
        simple: ${Panorama.EDL.Name}
      inbound-or-outbound-rule:
        complex:
          root: inputs.inbound-or-outbound-rule
      log-forwarding-object-name:
        complex:
          root: inputs.log-forwarding-object-name
      pre-post-rulebase:
        complex:
          root: inputs.pre-post-rulebase
      relative-rule-name:
        complex:
          root: inputs.relative-rule-name
      rule-position:
        complex:
          root: inputs.rule-position
      rule_name:
        complex:
          root: inputs.rule-name
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: "{\n  \"position\": {\n    \"x\": 1060,\n    \"y\": 1620\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '42':
    id: '42'
    taskid: b47e13f7-06e8-42d8-8acc-09d6ab7f4692
    type: condition
    task:
      id: b47e13f7-06e8-42d8-8acc-09d6ab7f4692
      version: -1
      name: Is auto-commit defined?
      description: Checks if the values provided in the arguments are equal. If either of the arguments are missing, "no" is returned.
      scriptName: AreValuesEqual
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      no:
      - '44'
      yes:
      - '49'
    scriptarguments:
      left:
        simple: ${inputs.auto-commit}
      right:
        simple: Yes
    results:
    - AreValuesEqual
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1060,\n    \"y\": 1280\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '44':
    id: '44'
    taskid: 6d679c49-0133-43a4-829e-2d49df0342b5
    type: regular
    task:
      id: 6d679c49-0133-43a4-829e-2d49df0342b5
      version: -1
      name: Manually commit
      description: Allows the analyst to manually commit the changes. This option is available when auto-commit is "false".
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '41'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1300,\n    \"y\": 1450\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '45':
    id: '45'
    taskid: 65e522d7-c2df-47d0-8684-4710e2e534e2
    type: regular
    task:
      id: 65e522d7-c2df-47d0-8684-4710e2e534e2
      version: -1
      name: Fetch Instance Info
      description: Run any command supported in the API.
      script: 'Panorama|||pan-os'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '46'
    scriptarguments:
      action: {}
      category: {}
      cmd:
        simple: <show><system><info></info></system></show>
      command: {}
      dst: {}
      element: {}
      extend-context:
        simple: panorama.model=response.result.system.model
      from: {}
      job-id: {}
      key: {}
      log-type: {}
      pcap-id: {}
      period: {}
      query: {}
      reportname: {}
      reporttype: {}
      search-time: {}
      serialno: {}
      target: {}
      to: {}
      type:
        simple: op
      where: {}
      xpath: {}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1710,\n    \"y\": 1090\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '46':
    id: '46'
    taskid: b3e65d83-e451-49db-84b5-c95e81d1054f
    type: condition
    task:
      id: b3e65d83-e451-49db-84b5-c95e81d1054f
      version: -1
      name: Is Instance type Panorama?
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '47'
      yes:
      - '35'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: panorama.model
            iscontext: true
          right:
            value:
              simple: Panorama
    view: "{\n  \"position\": {\n    \"x\": 1710,\n    \"y\": 1260\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '47':
    id: '47'
    taskid: 530e2470-d45e-400f-8a36-7106c1e0161b
    type: regular
    task:
      id: 530e2470-d45e-400f-8a36-7106c1e0161b
      version: -1
      name: Get EDL Object
      description: Returns information for an external dynamic list
      script: '|||pan-os-get-edl'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '35'
    scriptarguments:
      device-group: {}
      name:
        simple: ${inputs.list-name}-${inputs.ioc-type}-edl-object
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 2020,\n    \"y\": 1450\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '48':
    id: '48'
    taskid: c8f328b8-325c-4bb9-861b-6b2def304477
    type: playbook
    task:
      id: c8f328b8-325c-4bb9-861b-6b2def304477
      version: -1
      name: PAN-OS Commit Configuration
      playbookName: PAN-OS Commit Configuration
      type: playbook
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '3'
    separatecontext: true
    view: "{\n  \"position\": {\n    \"x\": 880,\n    \"y\": 1970\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '49':
    id: '49'
    taskid: 197e4c4f-f1a1-45e0-8e15-8f6c4086b9ff
    type: playbook
    task:
      id: 197e4c4f-f1a1-45e0-8e15-8f6c4086b9ff
      version: -1
      name: PAN-OS Commit Configuration
      playbookName: PAN-OS Commit Configuration
      type: playbook
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '41'
    separatecontext: true
    view: "{\n  \"position\": {\n    \"x\": 830,\n    \"y\": 1450\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
view: "{\n  \"linkLabelsPosition\": {\n    \"18_16_yes\": 0.44,\n    \"18_17_#default#\": 0.39,\n    \"1_3_#default#\": 0.1,\n    \"2_3_#default#\": 0.1,\n    \"2_7_yes\": 0.59\n  },\n  \"paper\": {\n    \"dimensions\": {\n      \"height\": 2155,\n      \"width\": 2145,\n      \"x\": 255,\n      \"y\": 50\n    }\n  }\n}"
inputs:
- key: list-name
  value: {}
  required: true
  description: "The name of the list that will store the IOCs.\nThe name of the file on the web server. This file name is the same as the name of the list with the extension \".txt\" added."
- key: ioc-type
  value: {}
  required: true
  description: The type of the IOCs that the list will store. Can be "ip", "url", or "domain".
- key: list-items
  value: {}
  required: true
  description: comma separated values
- key: action-type
  value:
    simple: drop
  required: true
  description: "The action that will be defined in the rule:\nallow/deny/drop"
- key: auto-commit
  value:
    simple: No
  required: false
  description: Whether to commit the configuration automatically.
- key: log-forwarding-object-name
  value: {}
  required: false
  description: The server address to which to forward logs.
- key: web-server-url
  value: {}
  required: true
  description: The full URL path of the web server on which the files are stored.
- key: pre-post-rulebase
  value:
    simple: pre-rulebase
  required: true
  description: Either pre-rulebase or post-rulebase,  according to the rule structure.
- key: rule-position
  value:
    simple: bottom
  required: false
  description: "The position of the rule in the ruleset. Valid values are:\n  * top\n  * bottom\n  * before\n  * after\n\nThe default position is 'top'"
- key: relative-rule-name
  value: {}
  required: false
  description: If the rule-position that is chosen is before or after, specify the rule name to which it is related.
- key: inbound-or-outbound-rule
  value:
    simple: outbound
  required: false
  description: Determines if the rule is inbound or outbound.
- key: rule-name
  value: {}
  required: false
  description: The name of the rule to update, or the name of the rule that will be created.
- key: device-group
  value: {}
  required: false
  description: The device group to work on. Exists only in panorama!
outputs:
- contextPath: Panorama.EDL.Name
  description: Name of theEDL.
- contextPath: Panorama.Commit.Warnings
  description: Commit Warnings
  type: unknown
- contextPath: Panorama.Push.Warnings
  description: Push  warnings
sourceplaybookid: PAN-OS EDL Setup v2
tests:
- PAN-OS EDL Setup v3 Test
supportedModules:
- agentix