- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
01-04-2012 10:29 AM
I have a customer that has asked me to match up an ISS proventia IPS rule to put a PAN Threat Prevention rule. I have created a enabled about 1009 rules on a custom ruleset to do so. The customer has asked that I "print off" in CSV or other format the " rules, showing which ones are enabled, what action is configured, against what is available..."
The GUI shows this very nicely in 138 pages, but I can not find a good way to pump that out into a presentable format. The only other method I have found is to export the config via .xml, but that only has the signature number, not description....
Please help
Cam
01-05-2012 12:20 AM
I have not tried this myself, but I think you import the xml part of the threat prevention config into excel, similar to importing the ruleset into excel, as described in https://live.paloaltonetworks.com/docs/DOC-1617
01-05-2012 07:09 AM
Thanks for the info, Bart!
That link gave me an error, can you please repost?
Thanks!
Cam
01-05-2012 07:13 AM
I corrected the link in my first post.
01-06-2012 07:45 AM
Thanks Bart!
I tried that, and am working through some problems I am having (suspect I have a mistake in my API query due to running 4.1.1) but I am headed in the right direction now. Thanks again!
Cam
01-19-2012 10:27 AM
SO I have had some success.... and still have some problems....
I have been working with the REST API, and am able to pull the rules with the threat ID, but I do not get the threat name, criticality, default action, etc.
I am using this xpath:
/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='FW1']/profiles/vulnerability
When I import that into excel, I get the columns for threat-name, category, default, etc. but no data in the fields...
The only data fields populated are the ID field, and the name of the profile, which is a start, but I need the other fields as well.
Any ideas?
Thanks!
Cam
01-19-2012 02:04 PM
The threat names are not part of the configuration. This is why you are not able to see that information. We have a threat database on the device from which you could pull that information.
For example – if you want to pull the threat name for threat id 30003, this is how you do
your action will be "get" and xpath="/config/predefined/threats/vulnerability" . However that xpath will display all the threat objects in the device. So make the xpath more fine grained by providing the threat id.
here is the xpath to get the name of the threat with threat id 30003.
So its two-step process. you might want to import all the vulnerabilities in to an excel and then merge those vulnerabilities that you are looking for in to your original excel.
Thanks,
krishna
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!