Python: panos opstate

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Python: panos opstate

L0 Member

I'm having tremendous success automating security policy updates with the panos Python library, but I'm currently stuck on obtaining the hit counts of rules programmatically. 

 

I'm able to access all attributes of the SecurityRule objects, but the opstate hit_count attributes all come back as None.

 

Relevant code;

if type(rule) is SecurityRule:
	print(f'\t{rule.name}')
	print(rule.opstate.hit_count.hit_count)
	print(rule.opstate.hit_count.latest)
	print(rule.opstate.hit_count.last_hit_timestamp)
	print(rule.opstate.hit_count.last_reset_timestamp)

output

    Rule Name
None
None
None
None

 

I've attempted to use the refresh method a number of different ways, but None is always what is returned. I have to be missing something silly, and I can't find what I need in the documentation.

 

https://pan-os-python.readthedocs.io/en/latest/module-policies.html#panos.policies.HitCount

 

Panorama is running 11.1.6-h3

1 REPLY 1

L0 Member

Making progress thanks to some of the comments here;

https://github.com/PaloAltoNetworks/pan-os-python/issues/388

 

Expanding the relevant code to show that running the refresh method on the the rulebase successfully populates the rule_creation_timestamp and rule_modification_timestamp.  These both will also return None without the refresh method.

for rulebase in theserulebases:
	print('...absoutely need to refresh the rulebase to get create/modify counts')
	rulebase.opstate.hit_count.refresh("security", all_rules=True)
	
	for rule in rulebase.children:
		if type(rule) is SecurityRule:
			print(f'\t{rule.name}')
						print(rule.opstate.hit_count.hit_count)
			print(rule.opstate.hit_count.latest)
			print(rule.opstate.hit_count.last_hit_timestamp)
			print(rule.opstate.hit_count.last_reset_timestamp)
			#- only these work after 
			print(datetime.fromtimestamp(rule.opstate.hit_count.rule_creation_timestamp))
			print(datetime.fromtimestamp(rule.opstate.hit_count.rule_modification_timestamp))

 

My next action is to retrieve Firewall objects and see what I can get from them.

  • 595 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!