How do I get a report of what threat prevention rules are enabled?

[cwilliams]

I have a customer that has asked me to match up an ISS proventia IPS rule to put a PAN Threat Prevention rule.   I have created a enabled about 1009 rules on a custom ruleset to do so.    The customer has asked that I "print off" in CSV or other format the " rules, showing which ones are enabled, what action is configured, against what is available..."

The GUI shows this very nicely in 138 pages, but I can not find a good way to pump that out into a presentable format.    The only other method I have found is to export the config via .xml, but that only has the signature number, not description....

Please help

Cam

[Bart_Jocque]

I have not tried this myself, but I think you import the xml part of the threat prevention config into excel, similar to importing the ruleset into excel, as described in https://live.paloaltonetworks.com/docs/DOC-1617

[cwilliams]

Thanks for the info, Bart!

That link gave me an error, can you please repost?

Thanks!

Cam

[Bart_Jocque · Accepted solution]

I corrected the link in my first post.

[cwilliams]

Thanks Bart!

I tried that, and am working through some problems I am having (suspect I have a mistake in my API query due to running 4.1.1) but I am headed in the right direction now.  Thanks again!

Cam

[cwilliams]

SO I have had some success.... and still have some problems....

I have been working with the REST API, and am able to pull the rules with the threat ID, but I do not get the threat name, criticality, default action, etc.  

I am using this xpath:

/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='FW1']/profiles/vulnerability

When I import that into excel, I get the columns for threat-name, category, default, etc.  but no data in the fields...

The only data fields populated are the ID field, and the name of the profile, which is a start, but I need the other fields as well.

Any ideas?

Thanks!

Cam

[ksomu]

The threat names are not part of the configuration.  This is why you are not able to see that information. We have a threat database on the device from which you could pull that information.

For example – if you want to pull  the threat name for threat id 30003, this is how you do

https://x.x.x.10/api/?type=config&key=hu6jy9KNvrN7oXLsRQMNZpd6JHdyawpcJU727bW0Z7o=&action=get&xpath=...

your action will be "get" and xpath="/config/predefined/threats/vulnerability" . However that xpath will display all the threat objects in the device. So make the xpath more fine grained by  providing the threat id.

https://x.x.x.10/api/?type=config&key=hu6jy9KNvrN7oXLsRQMNZpd6JHdyawpcJU727bW0Z7o=&action=get&xpath=...']

here is the xpath to get the name of the threat with threat id 30003.

https://x.x.x.10/api/?type=config&key=hu6jy9KNvrN7oXLsRQMNZpd6JHdyawpcJU727bW0Z7o=&action=get&xpath=...

So its  two-step process. you might want to import all the vulnerabilities in to an excel and then merge those vulnerabilities that you are looking for in to your original excel.

Thanks,

krishna