topic Re: Querying the Expedition database? in Expedition Discussions

Querying the Expedition database?

GM001 — Thu, 15 Sep 2022 18:01:39 GMT

Is there a way to query the Expedition database from the cli using mysql tools? I'd like to run custom audit queries against an imported configuration and it seems like Expedition has done all the hard work of parsing the configs into structured data. Not looking for anything fancy - just read-only access to the database to run SQL queries.

Re: Querying the Expedition database?

lychiang — Fri, 16 Sep 2022 16:00:39 GMT

Hi @GM001 Could you please send an email to fwmigrate@paloaltonetworks.com with the list of reports you need.

Re: Querying the Expedition database?

GM001 — Fri, 16 Sep 2022 17:15:15 GMT

I could, but I'd end up sending you a list of 60+ controls we audit for, and some are fairly complex like "show me all the policies that control traffic to the internet with a profile group that doesn't have packet capture enabled in the AV profile". These types of reports are very specific to our controls and would likely be meaningless to the larger community, so I would rather be the guy that learns to fish instead of expecting someone to hand me fish. 🙂 If I could get ODBC access to the database I could write these queries pretty quickly - assuming you have a reasonably normalized data model - so that's what I'm after. And if I need to do it through MySQL tools right on the box that's OK too. The alternative is I write a parser for the config files and get it all in a database myself, but as I mentioned, it sure looks like Expedition already does this so if I can avoid re-inventing the wheel that would be preferable.

Re: Querying the Expedition database?

lychiang — Fri, 16 Sep 2022 17:26:37 GMT

Hi @GM001 Please still send email to fwmigrate , so we can help you further.

Re: Querying the Expedition database?

GM001 — Fri, 16 Sep 2022 17:27:14 GMT

Will do, thanks!