topic Re: How do I get a report of what threat prevention rules are enabled? in General Topics

How do I get a report of what threat prevention rules are enabled?

cwilliams — Wed, 04 Jan 2012 18:29:47 GMT

I have a customer that has asked me to match up an ISS proventia IPS rule to put a PAN Threat Prevention rule. I have created a enabled about 1009 rules on a custom ruleset to do so. The customer has asked that I "print off" in CSV or other format the " rules, showing which ones are enabled, what action is configured, against what is available..."

The GUI shows this very nicely in 138 pages, but I can not find a good way to pump that out into a presentable format. The only other method I have found is to export the config via .xml, but that only has the signature number, not description....

Please help

Cam

Re: How do I get a report of what threat prevention rules are enabled?

Bart_Jocque — Thu, 05 Jan 2012 08:20:33 GMT

I have not tried this myself, but I think you import the xml part of the threat prevention config into excel, similar to importing the ruleset into excel, as described in https://live.paloaltonetworks.com/docs/DOC-1617

Re: How do I get a report of what threat prevention rules are enabled?

cwilliams — Thu, 05 Jan 2012 15:09:52 GMT

Thanks for the info, Bart!

That link gave me an error, can you please repost?

Thanks!

Cam

Re: How do I get a report of what threat prevention rules are enabled?

Bart_Jocque — Thu, 05 Jan 2012 15:13:24 GMT

I corrected the link in my first post.

Re: How do I get a report of what threat prevention rules are enabled?

cwilliams — Fri, 06 Jan 2012 15:45:57 GMT

Thanks Bart!

I tried that, and am working through some problems I am having (suspect I have a mistake in my API query due to running 4.1.1) but I am headed in the right direction now. Thanks again!

Cam

Re: How do I get a report of what threat prevention rules are enabled?

cwilliams — Thu, 19 Jan 2012 18:27:32 GMT

SO I have had some success.... and still have some problems....

I have been working with the REST API, and am able to pull the rules with the threat ID, but I do not get the threat name, criticality, default action, etc.

I am using this xpath:

/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='FW1']/profiles/vulnerability

When I import that into excel, I get the columns for threat-name, category, default, etc. but no data in the fields...

The only data fields populated are the ID field, and the name of the profile, which is a start, but I need the other fields as well.

Any ideas?

Thanks!

Cam

Re: How do I get a report of what threat prevention rules are enabled?

ksomu — Thu, 19 Jan 2012 22:04:29 GMT

The threat names are not part of the configuration. This is why you are not able to see that information. We have a threat database on the device from which you could pull that information.

For example – if you want to pull the threat name for threat id 30003, this is how you do

https://x.x.x.10/api/?type=config&key=hu6jy9KNvrN7oXLsRQMNZpd6JHdyawpcJU727bW0Z7o=&action=get&xpath=/config/predefined/threats/vulnerability/entry[@name='30003']/threatname

your action will be "get" and xpath="/config/predefined/threats/vulnerability" . However that xpath will display all the threat objects in the device. So make the xpath more fine grained by providing the threat id.

https://x.x.x.10/api/?type=config&key=hu6jy9KNvrN7oXLsRQMNZpd6JHdyawpcJU727bW0Z7o=&action=get&xpath=/config/predefined/threats/vulnerability/entry[@name='30003']

here is the xpath to get the name of the threat with threat id 30003.

https://x.x.x.10/api/?type=config&key=hu6jy9KNvrN7oXLsRQMNZpd6JHdyawpcJU727bW0Z7o=&action=get&xpath=/config/predefined/threats/vulnerability/entry[@name='30003']/threatname

So its two-step process. you might want to import all the vulnerabilities in to an excel and then merge those vulnerabilities that you are looking for in to your original excel.

Thanks,

krishna