Wildcards in rest api configuration query?

[KostiM]

Hi,

I'm trying to write a reporting tool that will go throguh various device groups and identify rules that have certain keywords (change numbers in my case) in the description.

I'm querying panorama configuration and using rest api directly from python (e.g. requests module or pan.xapi)

For example, this query works perfectly for me and as a result I get two rules returned back, if description contains only one string CHG99646:

/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Perth']/pre-rulebase/security/rules/entry[description="CHG99646"]

<response status="success" code="19">

<result total-count="2" count="2">

<entry name="Rule127" loc="Perth">...</entry>

<entry name="Rule139" loc="Perth">...</entry>

 ...

However, my queries stop working in case description contains multiple lines. E.g if my rule entry is like this:

<response status="success" code="19">

<result total-count="1" count="1">

<entry name="Rule87" loc="Perth">

<profile-setting>

<group>

<member>Source123</member>

</group>

...

...

<action>allow</action>

<description>CHG128742 CHG135069 CHG139311 CHG142080</description>

I am unable to find this rule if I put a query like

/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Perth']/pre-rulebase/security/rules/entry[description="CHG139311"]

Is there any way to have ~ (like) matching here or to use wildcards (e.g. .*<matchpattern>.*) so I could identify rule(s) based on part of the description content and not the entire decription content?

I am aware that I can pull the entire rulebase and then parse it localy. But the point here is to avoid this. If there are e.g. 20 device groups and each device group has 1000+ rules, pulling 20.000 rules will take forever and it would be much more efficient if I can just return rules matching certain patterns like explained above.

Thanks,

Milos

[cpainchaud]

Hi,

 The API is not designed for that. It has limited support for XPath and pulling data locally is probably the only way. 

 There are as well exisiting utilities which can do what you are looking for already, like one of mine here: https://live.paloaltonetworks.com/t5/API-Articles/rules-edit-php-to-manage-edit-export-rules-from-CL...

[KostiM]

OK, so Palo Alto decided not to implement %like% in their rest api. Understood.

Do you know if there is an op command that I could incorporate instead of using wildcards in the xpath matching? Something similar to global find in panorama gui or a | match when I am running show configuration? I mean, anything that will return a security rule name(s) based on text I want to find in description.

Cheers,

Milos

[cpainchaud · Accepted solution]

What I mean is that PAN is using Xpath, so you can use what Xpath has available:

In your case, something like that should work : 

[contains(text(),'whatYouWantHere')]

concerning your other question about Global Find and such : it's not exposed to through API unfortunatly. But it's somethign available on my project if you dont mind using it and/or developping in PHP 😉

[KostiM]

I'm trying to use your suggestion with contains text but I am not able to match anything

Could you give a full xpath example for matching description field with [contains(text(),'whatYouWantHere')]? I'm missing something when trying to use your suggestion.

For the PHP I have minimal knowledge there 🙂

Milos