- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
05-29-2025 05:01 PM
I'm having tremendous success automating security policy updates with the panos Python library, but I'm currently stuck on obtaining the hit counts of rules programmatically.
I'm able to access all attributes of the SecurityRule objects, but the opstate hit_count attributes all come back as None.
Relevant code;
if type(rule) is SecurityRule:
print(f'\t{rule.name}')
print(rule.opstate.hit_count.hit_count)
print(rule.opstate.hit_count.latest)
print(rule.opstate.hit_count.last_hit_timestamp)
print(rule.opstate.hit_count.last_reset_timestamp)
output
Rule Name
None
None
None
None
I've attempted to use the refresh method a number of different ways, but None is always what is returned. I have to be missing something silly, and I can't find what I need in the documentation.
https://pan-os-python.readthedocs.io/en/latest/module-policies.html#panos.policies.HitCount
Panorama is running 11.1.6-h3
05-30-2025 07:02 AM
Making progress thanks to some of the comments here;
https://github.com/PaloAltoNetworks/pan-os-python/issues/388
Expanding the relevant code to show that running the refresh method on the the rulebase successfully populates the rule_creation_timestamp and rule_modification_timestamp. These both will also return None without the refresh method.
for rulebase in theserulebases:
print('...absoutely need to refresh the rulebase to get create/modify counts')
rulebase.opstate.hit_count.refresh("security", all_rules=True)
for rule in rulebase.children:
if type(rule) is SecurityRule:
print(f'\t{rule.name}')
print(rule.opstate.hit_count.hit_count)
print(rule.opstate.hit_count.latest)
print(rule.opstate.hit_count.last_hit_timestamp)
print(rule.opstate.hit_count.last_reset_timestamp)
#- only these work after
print(datetime.fromtimestamp(rule.opstate.hit_count.rule_creation_timestamp))
print(datetime.fromtimestamp(rule.opstate.hit_count.rule_modification_timestamp))
My next action is to retrieve Firewall objects and see what I can get from them.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!

