id: PAN-OS Log Forwarding Setup And Configuration
version: -1
name: PAN-OS Log Forwarding Setup And Configuration
fromversion: 5.0.0
description: |-
  This playbook sets up and maintains log forwarding for the Panorama rulebase.
  It can be run when setting up a new instance, or as a periodic job to enforce log forwarding policy.
  You can either update all rules and override previous profiles, or update only rules that do not have a log forwarding profile configured.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 7e873ae1-3b70-44c6-88c7-02412b36edd8
    type: start
    task:
      id: 7e873ae1-3b70-44c6-88c7-02412b36edd8
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: ba687fe6-5fca-47ea-8e06-96b6a46c74ed
    type: title
    task:
      id: ba687fe6-5fca-47ea-8e06-96b6a46c74ed
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 600,
          "y": 2150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: dcfda5d3-0a33-4de2-82b3-5561281dce01
    type: regular
    task:
      id: dcfda5d3-0a33-4de2-82b3-5561281dce01
      version: -1
      name: List Rules
      description: "List all rules"
      script: '|||pan-os-list-rules'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      device-group:
        simple: ${inputs.device-group}
      pre_post:
        simple: ${inputs.pre-post-rulebase}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 5b2f24d9-17a1-4c77-815a-d790c0e48565
    type: regular
    task:
      id: 5b2f24d9-17a1-4c77-815a-d790c0e48565
      version: -1
      name: 'Add log forwarding profile to all rules '
      description: Edit the rule and add a log forwarding profile. This overrides existing profiles.
      script: '|||pan-os-edit-rule'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      element_to_change:
        simple: log-forwarding
      element_value:
        simple: ${inputs.log-forwarding-name}
      pre_post:
        simple: ${inputs.pre-post-rulebase}
      rulename:
        complex:
          root: Panorama
          accessor: SecurityRule.Name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -60,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 382555b7-9ed7-483b-8545-d81f4ecb7e2e
    type: condition
    task:
      id: 382555b7-9ed7-483b-8545-d81f4ecb7e2e
      version: -1
      name: Is auto-commit defined?
      description: Check whether the values provided in arguments are equal. If either of the arguments is missing, the value "no" is returned.
      scriptName: AreValuesEqual
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "6"
      "yes":
      - "7"
    scriptarguments:
      left:
        simple: ${inputs.auto_commit}
      right:
        simple: "yes"
    results:
    - AreValuesEqual
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: 1c1fc4c9-32a2-4caa-8030-b9d6732f4eeb
    type: regular
    task:
      id: 1c1fc4c9-32a2-4caa-8030-b9d6732f4eeb
      version: -1
      name: Manually commit
      description: Allows the analyst to manually commit the changes. This is available if auto-commit is "false".
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 190,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: e1ad0e46-d6b0-4536-89ff-4c06849e515e
    type: playbook
    task:
      id: e1ad0e46-d6b0-4536-89ff-4c06849e515e
      version: -1
      name: PAN-OS Commit Configuration
      description: ""
      playbookName: PAN-OS Commit Configuration
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": -290,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: bfb7bb7b-a03d-4295-8160-8932a31ae6ac
    type: condition
    task:
      id: bfb7bb7b-a03d-4295-8160-8932a31ae6ac
      version: -1
      name: 'Should we override existing log forwarding profile?'
      description: Check if we should override existing profiles, or only update rules with no profile defined.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.override-existing-profiles
            iscontext: true
          right:
            value:
              simple: "True"
    view: |-
      {
        "position": {
          "x": 265,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: cd2c1788-157f-439f-8995-9f86101940bf
    type: regular
    task:
      id: cd2c1788-157f-439f-8995-9f86101940bf
      version: -1
      name: Add log forwarding profile to rules that don't have it
      description: Edit the rule and add a log forwarding profile. Update only rules that don't have a profile already defined.
      script: '|||pan-os-edit-rule'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      element_to_change:
        simple: log-forwarding
      element_value:
        simple: ${inputs.log-forwarding-name}
      pre_post:
        simple: ${inputs.pre-post-rulebase}
      rulename:
        complex:
          root: PanoramaSecurityRule
          filters:
          - - operator: isNotExists
              left:
                value:
                  simple: PanoramaSecurityRule.LogForwardingProfile
                iscontext: true
          accessor: Name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 360,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: ebac79c1-c50d-4321-89fd-f0ba3b115ac2
    type: regular
    task:
      id: ebac79c1-c50d-4321-89fd-f0ba3b115ac2
      version: -1
      name: Set security rules to context
      description: Sets a value into the context with the given context key.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      append: {}
      key:
        simple: PanoramaSecurityRule
      value:
        simple: ${Panorama.SecurityRule}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 600,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: b3db37d3-7b79-42f6-893c-a5ced31a7872
    type: condition
    task:
      id: b3db37d3-7b79-42f6-893c-a5ced31a7872
      version: -1
      name: Are there rules without a log forwarding profile configured?
      description: Checks if there are rules that have no log forwarding profile defined.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PanoramaSecurityRule
                filters:
                - - operator: isNotExists
                    left:
                      value:
                        simple: PanoramaSecurityRule.LogForwardingProfile
                      iscontext: true
                accessor: Name
            iscontext: true
    view: |-
      {
        "position": {
          "x": 600,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "12_10_yes": 0.31,
      "4_6_no": 0.76,
      "8_3_yes": 0.4
    },
    "paper": {
      "dimensions": {
        "height": 2165,
        "width": 1270,
        "x": -290,
        "y": 50
      }
    }
  }
inputs:
- key: log-forwarding-name
  value:
    simple: log_forwarding_101
  required: true
  description: The name of the log-forwarding object that will be attached to all of the rules.
- key: auto_commit
  value:
    simple: "yes"
  required: false
  description: Should the rule be committed automatically or manually?
- key: pre-post-rulebase
  value:
    simple: pre-rulebase
  required: true
  description: Either the pre-rulebase or post-rulebase, depending on the rule structure.
- key: device-group
  value: {}
  required: false
  description: The device group to work on.
- key: override-existing-profiles
  value:
    simple: "False"
  required: false
  description: Should we override log-forwarding profiles that were already defined.
outputs: []
tests:
- No Tests
supportedModules:
- agentix
- xsiam