Filtering panorama policies by modified date.

[Mike_VanHaaften]

I'm trying to do some auditing of firewall policies.  The organization that I'm working with is wanting an automated way to identify rules that have been disabled for 6 months so they can go in and delete them.  The thought I had was to look at the modified date and disabled status to identify the rules - I have seen suggestions about adding this data into the description or a tag, but I'm wanting to make this as light of a lift on the org as possible. 

I can make such a filter in the policy optimizer - (rule-modification-timestamp leq '2023-04-06 10:12:32') and (disabled eq 'yes') - , but that rule will not function in the - Security Post rules - section.

I do not see the ability to look at that data with a custom report - because it is only intended to parse through logs not configs.  I have parsed through the Security Post rules section in the api for other auditing and I don't see the Modified date in the XML output.  Nor do I see the ability to hit the policy optimizer via the API.  Since I want to automatically notify them on a schedule to these issues the API has been where I have historically gone to conduct audits.

Hoping someone can point me in the right direction to either run a query in the policy optimizer from the api or point me to where I can find the modified date in the api.

[akuzhuppilly]

Hello @Mike_VanHaaften 

You may check if a rule is disabled using below API call:

https://{{host}}/api/?key={{key}}&type=config&action=show&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='{{rulename}}']

The response will have the 'disabled' element set if the rule is disabled.

Here is a sample output:

<action>allow</action>
<disabled>yes</disabled>
</entry>
</result>
</response>

I am not sure if you will be able to get the rule 'modified' details, this information is obtained from the config audit logs.