Filtering panorama policies by modified date.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Filtering panorama policies by modified date.

L0 Member

I'm trying to do some auditing of firewall policies.  The organization that I'm working with is wanting an automated way to identify rules that have been disabled for 6 months so they can go in and delete them.  The thought I had was to look at the modified date and disabled status to identify the rules - I have seen suggestions about adding this data into the description or a tag, but I'm wanting to make this as light of a lift on the org as possible. 

 

I can make such a filter in the policy optimizer - (rule-modification-timestamp leq '2023-04-06 10:12:32') and (disabled eq 'yes') - , but that rule will not function in the - Security Post rules - section.

 

I do not see the ability to look at that data with a custom report - because it is only intended to parse through logs not configs.  I have parsed through the Security Post rules section in the api for other auditing and I don't see the Modified date in the XML output.  Nor do I see the ability to hit the policy optimizer via the API.  Since I want to automatically notify them on a schedule to these issues the API has been where I have historically gone to conduct audits.

 

Hoping someone can point me in the right direction to either run a query in the policy optimizer from the api or point me to where I can find the modified date in the api.

1 REPLY 1

L4 Transporter

Hello @Mike_VanHaaften 

You may check if a rule is disabled using below API call:

 

https://{{host}}/api/?key={{key}}&type=config&action=show&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='{{rulename}}']

 

The response will have the 'disabled' element set if the rule is disabled.

Here is a sample output:

 

<action>allow</action>
<disabled>yes</disabled>
</entry>
</result>
</response>

 

I am not sure if you will be able to get the rule 'modified' details, this information is obtained from the config audit logs.

 

Anoopkumar
Network Security Engineer
  • 1108 Views
  • 1 replies
  • 0 Likes
  • 29 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!