Is there an XML API query to find the Host-ID from Panorama logs

John_J — Wed, 15 May 2024 17:28:02 GMT

Is there a way to use XML API to query the Host-ID from Panorama logs?

I have the XML API requests to remove a user from the VPN and to add a user's device to a quarantine list working. To add a user's device to the quarantine list requires the Host-ID. I'm trying to find a way to get the Host-ID for a specific user using API and not the GUI.

Re: Is there an XML API query to find the Host-ID from Panorama logs

John_J — Wed, 15 May 2024 18:18:05 GMT

Figured it out:
##Generate logs filtering for srcuser##

https://<FIRERWALL_NAME>/api?key=<API_KEY>&type=log&log-type=globalprotect&query=(srcuser eq 'USERNAME')

This will return a Job ID which will be used in the next command.

##Show the log you just created##

https://<FIRERWALL_NAME>/api?key=<API_KEY>&type=log&action=get&job-id=JOB_ID

This will show the logs related to the username in the first API request. The Host-ID is included in this data.

##Delete the job log you created##

https://<FIRERWALL_NAME>/api?key=<API_KEY>&type=log&action=finish&job-id=JOB_ID

topic Is there an XML API query to find the Host-ID from Panorama logs in GlobalProtect Discussions

Is there an XML API query to find the Host-ID from Panorama logs

Re: Is there an XML API query to find the Host-ID from Panorama logs