Filtering panorama policies by modified date.

Mike_VanHaaften — Fri, 06 Oct 2023 17:55:11 GMT

I'm trying to do some auditing of firewall policies. The organization that I'm working with is wanting an automated way to identify rules that have been disabled for 6 months so they can go in and delete them. The thought I had was to look at the modified date and disabled status to identify the rules - I have seen suggestions about adding this data into the description or a tag, but I'm wanting to make this as light of a lift on the org as possible.

I can make such a filter in the policy optimizer - (rule-modification-timestamp leq '2023-04-06 10:12:32') and (disabled eq 'yes') - , but that rule will not function in the - Security Post rules - section.

I do not see the ability to look at that data with a custom report - because it is only intended to parse through logs not configs. I have parsed through the Security Post rules section in the api for other auditing and I don't see the Modified date in the XML output. Nor do I see the ability to hit the policy optimizer via the API. Since I want to automatically notify them on a schedule to these issues the API has been where I have historically gone to conduct audits.

Hoping someone can point me in the right direction to either run a query in the policy optimizer from the api or point me to where I can find the modified date in the api.

Re: Filtering panorama policies by modified date.

akuzhuppilly — Fri, 13 Oct 2023 07:53:22 GMT

Hello @Mike_VanHaaften

You may check if a rule is disabled using below API call:

https://{{host}}/api/?key={{key}}&type=config&action=show&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='{{rulename}}']

The response will have the 'disabled' element set if the rule is disabled.

Here is a sample output:

<action>allow</action> <disabled>yes</disabled> </entry> </result> </response>

I am not sure if you will be able to get the rule 'modified' details, this information is obtained from the config audit logs.

topic Re: Filtering panorama policies by modified date. in Panorama Discussions

Filtering panorama policies by modified date.

Re: Filtering panorama policies by modified date.