topic Re: Filter security policies by no description in General Topics

Filter security policies by no description

PaulParlevliet — Mon, 30 Jul 2018 06:26:02 GMT

I am trying to view only security policies that do not have a description. I have found the following links but am unable to get the output i need. I need to show rules with no description and for all the operations i must define a valuen and all i am after is a NUL.

https://www.paloaltonetworks.com/documentation/traps/4-2/traps-endpoint-security-manager-admin/getting-started-with-rules/common-rule-components-and-actions/filter-rules

https://www.paloaltonetworks.com/documentation/41/endpoint/endpoint-admin-guide/getting-started-with-rules/common-rule-components-and-actions/filter-rules

Re: Filter security policies by no description

Remo — Mon, 30 Jul 2018 08:05:54 GMT

@PaulParlevliet

So far I don't know if this is possible in the WebUI. But with the XML config and a XPATH query this definately can be done.

Re: Filter security policies by no description

reaper — Mon, 30 Jul 2018 09:23:43 GMT

This is not possible in the GUI, you need to do a 'positive match' search for values, but a policy without description does not have a matching XML entry to match, so you can't search for an 'empty' xpath either (unless you do a search for the surrounding attributs:)

eg. 'with' description

                  <action>allow</action>
                  <description>General Internet Traffic</description>
                  <log-setting>default</log-setting>

'without' description

                  <action>allow</action>
                  <log-setting>default</log-setting>

a (dirty) workaround in the GUI is to search for (description neq 'null') (or any other single word that is not used as a description). The resulting filtered view will show you all rules except the ones without description, so you can see which ones are missing by the missing rule numbers