Automation/API Discussions

PA 3020 issue with XML API

We are having an issue with our PA-3020 and doing a partialcommit via the XML API. I am trying to do a partial commit of only the Policies andObjects. When I initiate the commit from the XML API it appears to queue upsuccessfully, and according to the web interface of the 3020, itsuccessfully commits. However the changes that were pending did n...

XML API query to get detail information on Spyware IDs

Hello,One of our customer has a question whether it is possible to get all spyware IDs using API?They can get all Threat IDs with API as described in „XML-API-5.0-revC.pdf“ page 5:Lower marking shows that all available xpaths are shown though API browser. But as far as I can get is this path:So for the question – is it possible to get all spywar...

deafult decryption

Hi,I run a HA-cluster of PA-5020 PAN OS 5.0.10I've just noticed that since I've upgraded from 5.0.8 to 5.0.10 a specific traffic was identified as web-browsing instead of as before SSL.It seems that traffic identified as web-browsing over port TCP 443 always is decrypted. Is this so? The only way I've managed to control this is by a Application ...

URL filtering with regex

Hi all,as far as I know this is not possible right now. Or maybe Im wrong? The possibility to use wildcards (and an idea of tokens) is not enaugh in my opinion.Are there any plans to implement it? It would be great if I could create custom category using regex. regards

Creating a custom signature on PAN

Hello, I'd like to create a custom signature on the PAN within the HTTP request that contains the following to be dropped. http://www.google.com/humans.txtfor example. http://example.com/test/index.php?example=http://www.google.com/humans.txt

How would I create a custom threat signature that looks for a server's "invalid username" response to a failed login attempt?

Hi,I'm new to Palo Alto and custom threat signatures. I'm trying to detect invalid login attempts to a web site and apply a time rate. When the user enters an invalid username in the login, the site returns the text "invalid username". Which context would I use to search for this pattern match? I read the "Creating Custom Signatures" document, b...

How to update the local-user-database user password

Looking for the payload data to update the '/config/shared/local-user-database/user' via the PA 5.0.10 API#! /usr/bin/pythonimport urllibimport urllib2 import sys# PaloAulto Firewall Managment IP Addressmypafw = '10.10.10.1';# PA API keymykey =mykey'; # Guest User Account 1 through 10# PA API for User-IDmycmd = "&type=config&action=set...

How do I monitor acc risk factor in cacti tool, via snmp?

How do I monitor acc risk factor in cacti tool, via snmp?as title

How to create a custom app signature to identify IE browsers when using http and https

I am looking for a way to create an custom application signature to identify IE browsers when accessing the internet and reliably identify it whether it is using http or https. Currently I have a custom app signature the works great when accessing http sites but fails when accessing https sites.I have set the custom app signature up with pattern...

How do I Create a dlp policy to detect private IPs using Regular Expressions or what Regular expression should I used for data pattern

API log export hard-coded to a 20 entry limit?

In panorama 5.1.5 code, I'm attempting to pull down traffic logs for analysis of application type vs rule. My query is structured like this:https://10.x.x.240/api/?type=log&log-type=traffic&query=%28%20receive_time%20geq%20%272012/12/31%2008:00:00%27%29&key=my…Which gives me a success return, along with "query job enqueued with jobi...

Grabbing user-id and ip's from SEP

All,I just posted up a perl script for grabbing users and ips from Symantec Endpoint Protection (SEP).Perl script to load users and IPs from Symantec Endpoint Protection (SEP)

report global vpn

HelloI'm looking for solution how to create custom report that shows login and logout of Global VPN users. In this report I need time of connection/disconnection IP login name and status (success or false) of connection.Help me pleaseWith regardsLuigi

Pan Migration Tool 2.06 support Migration from CP r75?

Hi,i looked all around, and i didnt find an answer to that question,please help,Thanks.

Help With An IPS Signature

I need to determine if a custom signature can be built to block traffic based on specific string in a URL request, such as: skn=8392I've since asked support and they've told me to post my question here as they saw nothing wrong with how things are configured in the inserted screen capture.

Discussions