How do I get a report of what threat prevention rules are enabled?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How do I get a report of what threat prevention rules are enabled?

Not applicable

I have a customer that has asked me to match up an ISS proventia IPS rule to put a PAN Threat Prevention rule.   I have created a enabled about 1009 rules on a custom ruleset to do so.    The customer has asked that I "print off" in CSV or other format the " rules, showing which ones are enabled, what action is configured, against what is available..."

The GUI shows this very nicely in 138 pages, but I can not find a good way to pump that out into a presentable format.    The only other method I have found is to export the config via .xml, but that only has the signature number, not description....

Please help Smiley Happy

Cam

1 accepted solution

Accepted Solutions

I corrected the link in my first post.

View solution in original post

6 REPLIES 6

L3 Networker

I have not tried this myself, but I think you import the xml part of the threat prevention config into excel, similar to importing the ruleset into excel, as described in https://live.paloaltonetworks.com/docs/DOC-1617

Thanks for the info, Bart!

That link gave me an error, can you please repost?

Thanks!

Cam

I corrected the link in my first post.

Thanks Bart!

I tried that, and am working through some problems I am having (suspect I have a mistake in my API query due to running 4.1.1) but I am headed in the right direction now.  Thanks again!

Cam

Not applicable

SO I have had some success.... and still have some problems....

I have been working with the REST API, and am able to pull the rules with the threat ID, but I do not get the threat name, criticality, default action, etc.  

I am using this xpath:

/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='FW1']/profiles/vulnerability

When I import that into excel, I get the columns for threat-name, category, default, etc.  but no data in the fields...

The only data fields populated are the ID field, and the name of the profile, which is a start, but I need the other fields as well.

Any ideas?

Thanks!

Cam

The threat names are not part of the configuration.  This is why you are not able to see that information. We have a threat database on the device from which you could pull that information.

For example – if you want to pull  the threat name for threat id 30003, this is how you do

https://x.x.x.10/api/?type=config&key=hu6jy9KNvrN7oXLsRQMNZpd6JHdyawpcJU727bW0Z7o=&action=get&xpath=...

your action will be "get" and xpath="/config/predefined/threats/vulnerability" . However that xpath will display all the threat objects in the device. So make the xpath more fine grained by  providing the threat id.


https://x.x.x.10/api/?type=config&key=hu6jy9KNvrN7oXLsRQMNZpd6JHdyawpcJU727bW0Z7o=&action=get&xpath=...']

here is the xpath to get the name of the threat with threat id 30003.

https://x.x.x.10/api/?type=config&key=hu6jy9KNvrN7oXLsRQMNZpd6JHdyawpcJU727bW0Z7o=&action=get&xpath=...

 

So its  two-step process. you might want to import all the vulnerabilities in to an excel and then merge those vulnerabilities that you are looking for in to your original excel.

Thanks,

krishna

  • 1 accepted solution
  • 4237 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!