Panorama API ServiceNow integration, getting Hit Counts

[M.Albisser]

Dear Community

We try to get out the hit counts from the API connection between Panorama and ServiceNow. Is there someone in the community who has experience where the hit counts can be read out? Within the API documentation, we were not able to get more details. We are able to read the whole rules, their object groups and also the objects. But we miss the way how to read the hit counts for a specific rule (even if the field exists).

Any help would be appreciated.

Many thanks

Markus

[JayGolf · Accepted solution]

Hi @M.Albisser ,

Hit counts aren’t returned when retrieving the rulebase through the configuration API. They are runtime counters maintained by the dataplane, so they need to be queried through the operational API (type=op) instead.

You can retrieve them using an operational command similar to the following:

<show>
  <rule-hit-count>
    <vsys>
      <vsys-name>
        <entry name="vsys1">
          <rule-base>
            <entry name="security">
              <rules>
                <all/>
              </rules>
            </entry>
          </rule-base>
        </entry>
      </vsys-name>
    </vsys>
  </rule-hit-count>
</show>

**FYI, I tested this against a ngfw where I don't have multi-vsys enabled.

You can experiment with the request via FW API browser, which will generate the XML structure for the operational command. From there you should be able to incorporate the request into your API call from SNOW. 

Hope this helps! Please let us know if you are able to get this operational. 

[M.Albisser]

Hi JayGolf

Many thanks for your feedback. I forwarded your answer to the guys who are implementing the API. As soon I have a feedback, I will let you know and I then also will rate the answer.

Thank you

Markus

[M.Albisser]

Thank you Jay for your reply. This helped our ServiceNow engineer to get the hit counts via API

[JayGolf]

Great to hear. Cheers! @M.Albisser