About SRA

SRA · ‎04-03-2012

You can submit requests for new applications here: http://www.paloaltonetworks.com/researchcenter/submit-an-application/

SRA · ‎03-29-2012

The threat research team is investigating if this can be covered using a vulnerability signature in a future content update.

SRA · ‎02-27-2012

See the API Guide for 4.1 at https://live.paloaltonetworks.com/docs/DOC-1981

SRA · ‎02-27-2012

The force and partial commit options are explained in the CLI guide. See snippet below: Syntax commit {force} { partial device-and-network excluded | partial shared-object excluded | partial vsys <value> | partial no-vsys } Options > force — Forces the commit command in the event of a conflict > partial — Commits the specified part of the configuration + device-and-network — Excludes device and network configurations from the commit (configurations under config/mgt-config, config/devices/platform, config/devices/deviceconfig, and config/devices/network) + shared-object — Excludes shared object configurations from the commit (configurations under (config/ shared; also excludes config/devices/vsys if in single vsys mode) + vsys — Commits only the specified virtual system configurations > no-vsys — Excludes all virtual systems from the commit (configurations under config/devices/vsys)

SRA · ‎02-21-2012

PAN-OS 4.1.3 resolved an issue where a superuser-readonly admin account was not able to run Operational commands with the API.

SRA · ‎02-21-2012

Is the admin a superuser or a device or vsys admin? As of PAN-OS 4.1, the API only supports superuser admins only.

SRA · ‎02-15-2012

From PAN-OS 4.1 onwards, the search box under Objects>Applications can be used to search for apps by port numbers. The Applipedia page on research center also supports search by ports.

SRA · ‎02-07-2012

You can restrict rules by adding other match criteria to the policy. In addition to source address, you could also restrict by the URL category to handle dependencies on web-browsing. Many of the AV updates do go over HTTP, but with symantec-update you will need to allow FTP as the update file is retrieved only after the initial login is allowed. For a centralized av mgmt, source addr could be limited to just a single server too. For clearspace, the dependency on http-proxy may be in error. You need it only if you have a proxy setup. In that case, you can restrict the rule by the destination addr of the proxy. We'll fix this in a future content update. We are also working on simplifying application dependencies in the future, where some of the dependencies could be handled implicitly.

SRA · ‎02-02-2012

Use the command: PM-PA-2020> show system logdb-quota Quotas: traffic: 32.00%, 38.123 GB threat: 16.00%, 19.061 GB system: 4.00%, 4.765 GB config: 4.00%, 4.765 GB alarm: 3.00%, 3.574 GB trsum: 7.00%, 8.339 GB hourlytrsum: 3.00%, 3.574 GB dailytrsum: 1.00%, 1.191 GB weeklytrsum: 1.00%, 1.191 GB thsum: 2.00%, 2.383 GB hourlythsum: 1.00%, 1.191 GB dailythsum: 1.00%, 1.191 GB weeklythsum: 1.00%, 1.191 GB appstat: 12.00%, 14.296 GB userid: 1.00%, 1.191 GB hipmatch: 3.00%, 3.574 GB application-pcaps: 1.00%, 1.191 GB threat-pcaps: 1.00%, 1.191 GB debug-filter-pcaps: 1.00%, 1.191 GB hip-reports: 1.00%, 1.191 GB dlp-logs: 1.00%, 1.191 GB Disk usage: traffic: Logs: 4.7G, Index: 2.2G threat: Logs: 2.7G, Index: 511M system: Logs: 4.4G, Index: 380M config: Logs: 616M, Index: 9.1M alarm: Logs: 3.1M, Index: 660K trsum: Logs: 1.2G, Index: 114M hourlytrsum: Logs: 125M, Index: 25M dailytrsum: Logs: 77M, Index: 20M weeklytrsum: Logs: 59M, Index: 10M thsum: Logs: 823M, Index: 24M hourlythsum: Logs: 7.0M, Index: 13M dailythsum: Logs: 3.6M, Index: 11M weeklythsum: Logs: 1.2M, Index: 2.0M appstatdb: Logs: 37M, Index: 21M userid: Logs: 968M, Index: 788K hipmatch: Logs: 20K, Index: 20K application-pcaps: 98M threat-pcaps: 472M debug-filter-pcaps: 199M dlp-logs: 12M hip-reports: 1.1M wildfire: 12K

SRA · ‎01-27-2012

>>> I would have thought that finding a match at login and identifying the traffic to the 'session' once would be sufficient. This is true if all the traffic that follows happens on that initial session, not if it happens on a new session. Each new session is processed independently, so you will require a pattern to search on it.

SRA · ‎01-23-2012

You cannot login to your Rockmelt browser if you have facebook application blocked. You can only browse in logged-out mode without access to facebook.

SRA · ‎01-18-2012

Not via the API. You could perhaps try an expect script to use the CLI instead.

SRA · ‎01-18-2012

I'm guessing you must already be URL encoding the key and other parameters. It is not apparent to me what the issue could be. Please open a case with support along with info on the actual commands used and other data in this thread.

SRA · ‎01-18-2012

Could you provide some info on : What PAN-OS version is this on? What are you using to run the api - curl, wget? Are the 5 or 6 queries run in a sequence or in parallel?

SRA · ‎01-17-2012

To add an address object to a vsys: http(s)://firewall/esp/restapi.esp?type=config&action=set& xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address& element=<entry name='test-addr'><ip-netmask>2.2.2.2/32</ip-netmask></entry> To add the address object to a address group: http(s)://firewall/esp/restapi.esp?type=config&action=set& xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='test-addr-grp']& element=<member>test-addr</member>

Member Since	‎05-24-2010 03:26 PM
Date Last Visited	‎05-12-2026 06:28 PM
Posts	123
Total Likes Received	19

Online Status	Offline
Date Last Visited	‎05-12-2026 06:28 PM

About SRA

Re: Fingerprinting Acunetix

Re: Fingerprinting Acunetix

Re: Fingerprinting Acunetix

Re: Another PA bypass

Re: Importing anti-virus content using cURL and XML-API

Re: Upload Config to Palo with API

Re: GMAIL Base and SMTP - WTF??

Re: GMAIL Base and SMTP - WTF??

Re: GMAIL Base and SMTP - WTF??

Re: Error Generating API Key on PA-2020 with PAN 4.1.7

Re: Upload Config to Palo with API

Re: FIPS mode algorithm decryption?

Re: Capturing and logging dot1x traffic

Re: Capturing and logging dot1x traffic

Re: Need assistance creating a custom application

Inline Prevention of AI-Generated Malware with Advanced WildFire and Prisma Access Explicit Proxy

Cloud-Delivered Security Service Newsletter--November 2025

Newsletter: Cloud Delivered Security Services, Aug-Sep, 2025

Advanced Threat Prevention Achieves 2024 IRAP Cloud Security Assessment Compliance

Palo Alto Networks Leads in C2 Threat Prevention

Re: Siteminder Authentication Application

Re: Detecting VNC without a password

Re: How can I get the device serial number thru the rest API?

Re: PAN 4.1 Forced and Partial commits

Re: REST API Error: "Request Invalid, User or Password not defined"

Re: REST API Error: "Request Invalid, User or Password not defined"

Re: Looking for AppID's which uses a defined TCP Port

Re: Applications and their dependencies

Re: View Log Size

Re: Need assistance creating a custom application

Re: Rockmelt

Re: VPN and XML Api

Re: Intermittent error using XML Api

Re: Intermittent error using XML Api

Re: Add shared Object in REST API

Unlock your full community experience!

About SRA