<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Retrieve ACC information via XML API in Automation/API Discussions</title>
    <link>https://live.paloaltonetworks.com/t5/automation-api-discussions/retrieve-acc-information-via-xml-api/m-p/78639#M1229</link>
    <description>Hi,

is there a way to query information shown in the ACC (for example the top applications of user with the IP ...) via the API?

Could not find anything thus far.

Thanks,
Moritz</description>
    <pubDate>Wed, 25 May 2016 12:45:29 GMT</pubDate>
    <dc:creator>moritzxcontrol</dc:creator>
    <dc:date>2016-05-25T12:45:29Z</dc:date>
    <item>
      <title>Retrieve ACC information via XML API</title>
      <link>https://live.paloaltonetworks.com/t5/automation-api-discussions/retrieve-acc-information-via-xml-api/m-p/78639#M1229</link>
      <description>Hi,

is there a way to query information shown in the ACC (for example the top applications of user with the IP ...) via the API?

Could not find anything thus far.

Thanks,
Moritz</description>
      <pubDate>Wed, 25 May 2016 12:45:29 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/automation-api-discussions/retrieve-acc-information-via-xml-api/m-p/78639#M1229</guid>
      <dc:creator>moritzxcontrol</dc:creator>
      <dc:date>2016-05-25T12:45:29Z</dc:date>
    </item>
    <item>
      <title>,Re: Retrieve ACC information via XML API</title>
      <link>https://live.paloaltonetworks.com/t5/automation-api-discussions/retrieve-acc-information-via-xml-api/m-p/88957#M1237</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I think you can do this through a custom report using the API.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;For example, to retrive information about some applications, you could run:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;cmd_string_0 = "&amp;lt;type&amp;gt;&amp;lt;trsum&amp;gt;&amp;lt;group-by&amp;gt;app&amp;lt;/group-by&amp;gt;&amp;lt;aggregate-by&amp;gt;&amp;lt;member&amp;gt;from&amp;lt;/member&amp;gt;&amp;lt;member&amp;gt;to&amp;lt;/member&amp;gt;&amp;lt;member&amp;gt;dst&amp;lt;/member&amp;gt;&amp;lt;member&amp;gt;src&amp;lt;/member&amp;gt;&amp;lt;member&amp;gt;hour-of-receive_time&amp;lt;/member&amp;gt;&amp;lt;member&amp;gt;rule&amp;lt;/member&amp;gt;&amp;lt;/aggregate-by&amp;gt;&amp;lt;values&amp;gt;&amp;lt;member&amp;gt;sessions&amp;lt;/member&amp;gt;&amp;lt;member&amp;gt;bytes&amp;lt;/member&amp;gt;&amp;lt;/values&amp;gt;&amp;lt;/trsum&amp;gt;&amp;lt;/type&amp;gt;&amp;lt;period&amp;gt;last-30-days&amp;lt;/period&amp;gt;&amp;lt;topn&amp;gt;500&amp;lt;/topn&amp;gt;&amp;lt;topm&amp;gt;50&amp;lt;/topm&amp;gt;&amp;lt;caption&amp;gt;CustomRep_ValidarApps&amp;lt;/caption&amp;gt;"&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;custom_filter = "( app eq dns) or ( app eq ospf) or ( app eq ssl)"&lt;/P&gt;
&lt;P&gt;&lt;BR /&gt; cmd_concatenate_string = cmd_string_0 + "&amp;lt;query&amp;gt;" + custom_filter&amp;nbsp;+ "&amp;lt;/query&amp;gt;"&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;command = '''https://''' + IP_PRE + '''/api/?type=report&amp;amp;async=yes&amp;amp;reporttype=custom&amp;amp;vsys=vsys2&amp;amp;cmd=''' + cmd_concatenate_string + '''&amp;amp;key=''' + KEY_PRE&lt;/P&gt;
&lt;P&gt;&lt;BR /&gt; os.system('''wget --output-document=''' + answer_file_monitor&amp;nbsp;+ ''' "''' + command + '''" --no-check-certificate &amp;gt;/dev/null 2&amp;gt;/dev/null''')&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;With this simple Python function you can retrive the JOB:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;def retrive_job(IP_PANORAMA_PRE,KEY_PANORAMA_PRE,job_id,&lt;SPAN&gt;answer_file_monitor&lt;/SPAN&gt;&lt;span class="lia-unicode-emoji" title=":disappointed_face:"&gt;😞&lt;/span&gt;&lt;BR /&gt;command = '''https://''' + IP_PANORAMA_PRE + '''/api/?type=report&amp;amp;action=get&amp;amp;job-id=''' + job_id + '''&amp;amp;key=''' + KEY_PANORAMA_PRE&lt;BR /&gt; os.system('''wget --output-document=''' + answer_file_monitor&amp;nbsp;+ ''' "''' + commanda + '''" --no-check-certificate --no-check-certificate &amp;gt;/dev/null 2&amp;gt;/dev/null''')&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Of course you can modify this code to fit your needs. Note that the important part is the custom filter and the&amp;nbsp;&lt;SPAN&gt;cmd_string_0 defined.&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN&gt;Let me know if you need more info, I just adapted one old script I have.&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 17 Jun 2016 21:54:42 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/automation-api-discussions/retrieve-acc-information-via-xml-api/m-p/88957#M1237</guid>
      <dc:creator>MarcelST</dc:creator>
      <dc:date>2016-06-17T21:54:42Z</dc:date>
    </item>
  </channel>
</rss>

