Automating Tasks in PA

[ranghel.0915@gmail.com]

Hello,

Is there a way to automate tasks in Palo Alto PANORAMA?

For example, I want to create a script that allows me to add a “bulk list of objects”—including both IP addresses and domains—and then add them to an existing group.

The goal is to automate the blocking of security bulletins that arrive in our email inboxes every day.

Doing this manually in the PANORAMA GUI is a tedious task.

Is there a “practical” way to achieve this?

Please share any examples you might have to help me achieve my goal.

Thank you for your feedback.

[TomYoung]

Hi [email protected] ,

There are many ways that you can do it.

1. Perhaps the easiest way is to use a web feed instead of an email and create and External Dynamic List (EDL) on the NGFW to reference the web page.  Palo Alto also has built-in EDLs for threat feeds.
2. You could write a script (or a spreadsheet) that parses the email data and generates set commands that you can paste into the CLI in one fell swoop.
3. You could build an automation platform that receives the email, parses the data, and configures Panorama directly through the API. The XML API is easier than REST.

Palo Alto used to have an awesome free tool called MineMeld that could mine threat intelligence feeds in different formats such as STIX, TXT, JSON, and CSV and meld them together (with deduplication) to build a single EDL.  It is no longer supported.  If you need to translate feeds, you would need to purchase XSOAR TIM or find suitable 3rd party alternatives.  EDLManager.com has a few threat intelligence feeds for a very reasonable price.

https://docs.paloaltonetworks.com/network-security/security-policy/administration/objects/external-d...

https://docs.paloaltonetworks.com/network-security/security-policy/administration/objects/external-d...

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/about-the-pan-os-xml-api

Thanks,

Tom

[ranghel.0915@gmail.com]

Hello,
Thank you for your response.
Is it possible to implement these automations using Python scripts?
I’m thinking of creating a Python script that communicates with “Panorama” to achieve this type of automation, which would make it easier for me to create IP/FQDN objects in bulk and add them to groups that are already up and running.
Do you think this is possible?

[TomYoung]

Hi [email protected] ,

Python has all the tools you need to automate these tasks.  For example, the Requests module can send the API requests to Panorama.

Thanks,

Tom