About ksteves1

ksteves1 · ‎08-10-2018

Update: DagPusher node now handles IPv6 indicators.

ksteves1 · ‎12-16-2016

python requests library uses its own CA store and certifi store. but we have to investigate more how to best handle this. stay tuned. thanks!

ksteves1 · ‎12-16-2016

you can use QUERY_STRING on feed URL of s=start, n=num as discussed here: https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Confused-over-EBL-size-limit/m-p/104038/

ksteves1 · ‎12-03-2016

1 more: you can now use api_key in the minemeld.ft.dag.DagPusher device list, instead of api_username/api_password.

ksteves1 · ‎11-23-2016

This may be helpful: http://api-lab.paloaltonetworks.com/user-ip.html

ksteves1 · ‎11-23-2016

You would need to have at least this version: 2012-08-30 - PAN::XAPI, bin/panxapi: add support for updating dynamic objects in PAN-OS 5.0 (type=user-id).

ksteves1 · ‎11-22-2016

Also see the commit message for more info: https://github.com/PaloAltoNetworks/minemeld-core/commit/db8ba28b29107c72d1f3f56232aac018ba1a8974 Connect nodes with prototype ers_sgt to sgt_dag, for example: nodes: ers_sgt-1477772195510: inputs: [] output: true prototype: ciscoise.ers_sgt sgt_dag-1477848600338: inputs: - ers_sgt-1477772195510 node_type: output output: false prototype: ciscoise.sgt_dag You need a device list file with the PAN-OS API configuration: minemeld@minemeld:/opt/minemeld/local/config$ cat sgt_dag-1477848600338_device_list.yml - hostname: 192.168.1.101 api_username: admin api_password: admin - hostname: 192.168.1.102 api_username: admin api_password: admin Then you can create DAGs with match criteria using the registered-ips. admin@PA-200-2> show object registered-ip all registered IP Tags ---------------------------------------- ----------------- 192.168.1.1 "mmld_ise_sgt_Guests" "mmld_pushed" 192.168.1.2 "mmld_ise_sgt_Quarantined_Systems" "mmld_pushed" 172.25.1.1 "mmld_ise_sgt_Contractors" "mmld_pushed" 10.0.0.1 "mmld_ise_sgt_BYOD" "mmld_ise_sgt_Developers" "mmld_ise_sgt_Employees" "mmld_pushed" Total: 4 registered addresses *: received from user-id agent #: persistent

ksteves1 · ‎11-04-2016

Hi, 1) no need to specify api_username and api_password when api_key is specified 2) should handle exceptions 3) to see request XML response use for example: https://github.com/kevinsteves/pan-python/blob/master/doc/pan.xapi.rst#xml_result

ksteves1 · ‎10-10-2016

There is a video to describe this. A few things have changed I think. Does this help? https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Video-MineMeld-on-AWS-amp-Autofocus-Export-Lists/m-p/73245#M11

ksteves1 · ‎07-17-2016

The XPath cannot end in slash. For example: $ ./panxapi.py -t p30443 -xS '<ip-address>192.168.1.102</ip-address>' "/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/" set: error [code="13"]: "set failed, may need to override template object first" <response code="13" status="error"><msg><line>set failed, may need to override template object first</line></msg></response> $ ./panxapi.py -t p30443 -xS '<ip-address>192.168.1.102</ip-address>' "/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system" set: success [code="20"]: "command succeeded" <response code="20" status="success"><msg>command succeeded</msg></response>

ksteves1 · ‎07-11-2016

Is there a download file link in the analysis report for the sample on the wildfire portal? suggest you log a case for this as it should work if you submitted the sample and its verdict is malware.

ksteves1 · ‎07-07-2016

I tested cloud and get/sample works for me. What is the sample verdict? get/sample will not return benign samples.

ksteves1 · ‎06-30-2016

on 6.1 there is an error but not on 7.0 or 7.1: 6.1.12: admin@PA-200> test vpn ipsec-sa tunnel foo Server error : foo is invalid tunnel.Current target-vsys is none test -> vpn -> ipsec-sa -> tunnel is invalid 7.0.8 and 7.1.3: admin@PA-200-2> test vpn ipsec-sa tunnel foo Initiate 0 IPSec SA for tunnel foo. type=op request using API have same results. seems like it may be a bug, as I would expect an error and behavior to be unchanged in 7.x suggest to log a case.

ksteves1 · ‎06-30-2016

I'm not sure if your XML for cmd is valid, but if it is it should be this for your op variable: <request><certificate><generate><signed-by>GP-SKY-CA</signed-by><days-till-expiry>90</days-till-expiry><certificate-name>CERTPRUEBA</certificate-name><algorithm><RSA><rsa-nbits>512</rsa-nbits></RSA></algorithm><name>CERTPRUEBA</name></generate></certificate></request> and cmd_xml should be False because you are passing an XML document. make those changes and test again.

ksteves1 · ‎05-18-2015

curl doesn't URL-encode your GET QUERY_STRING. also, you want to remove the outer <entry> container on your cmd= XML. Suggest you use POST and try something like this: $ curl -k -d "type=report&reporttype=dynamic&reportname=custom-dynamic-report&key=$KEY" --data-urlencode "cmd=<type><panorama-trsum><sortby>sessions</sortby><aggregate-by><member>app</member><member>srcuser</member></aggregate-by><values><member>sessions</member><member>bytes</member></values></panorama-trsum></type><period>last-24-hrs</period><topn>50</topn><topm>10</topm><caption>office-user-report</caption><query>(addr in '192.168.1.0/24') and (app neq dns) and (app neq ntp)</query>" https://172.25.1.251/api/

ksteves1 · ‎11-03-2014

I think the problem is ' -e testurl.xml' should be '-e ./testurl.xml'; otherwise it is not read as a file. using the Python panxapi.py you could specify ' -e testurl.xml'

ksteves1 · ‎10-22-2014

this may be useful for what you are doing: https://github.com/kevinsteves/pan-python/blob/master/doc/panconf.rst

ksteves1 · ‎09-30-2014

pancli is a wrapper around PAN::CLI and the CLI_operational_mode_exec() method. for documentation use 'perldoc CLI.pm'

ksteves1 · ‎10-26-2013

action 'get' with xpath '/config/predefined/threats/vulnerability' this has some related information: Re: Listing all of vulnerability or phone-home signature the JSON Template stuff is very powerful but complicated at first glance. a simple variation to just output JSON is: $ panxapi.py -t pa-200 -grj /config/predefined/threats/vulnerability|head -20 get: success }, "default-action": "alert", "name": "35931", "p": "yes", "severity": "high", "threatname": "HP Data Protector OmniInet Opcode Buffer Overflow Vulnerability" }, {

ksteves1 · ‎10-10-2013

your show and set command (the one I quoted) look correct, so I think it may be something else. need to see the error message in the XML response.

ksteves1 · ‎10-09-2013

the HASH() is because the response XML format is not recognized. run panxapi with -x which will print the full XML response and see if it shows clues. panxapi -x -h $pan -S ./temp_security.xml "/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Primary_Burlington_PA5020']/pre-rulebase"

ksteves1 · ‎08-20-2013

If you want to "replace" the 'destination' node, which I think is what you are trying to do, use edit (-e) with that xpath and element and it should work. There is an example in panxapi.html 'Edit the application of a security rule.' which covers a very similar case. An area not explained in the XML API documentation is: what is the difference between set and edit? I cover this a little in pan.xapi.html and in more detail in some of my API training.

ksteves1 · ‎07-12-2013

you are missing the apikey. I use -d in the below because you don't need a multipart/form-data request, but -F will work also. KEY=xxx $ curl -i -d "apikey=$KEY" -d device_id=00xxx -d report_id=247406568 https://wildfire.paloaltonetworks.com/publicapi/report HTTP/1.1 200 OK Server: nginx/1.0.9 Date: Sat, 13 Jul 2013 00:23:43 GMT Content-Type: text/xml; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.3.6 <wildfire> <report> <version>0.1</version> <task>353397118</task> <sha256>8122940e894a0dafa2fc75310909d83646dfdea2e30845511c1dc697be7b779c</sha256> <md5>eadf7415867bfaa3dc4c34c1016f6440</md5> <size>707120</size> <malware>yes</malware>

ksteves1 · ‎07-02-2013

I don't know how to get it via the API. It doesn't appear to be in 'show system state' output, which can be a good source for stuff like this.

ksteves1 · ‎06-26-2013

I would guess it happens with curl also? $ KEY='cBwvtXHyrHp9EkOmJ/3PxYV5QG9XiMEsJRoBMhhh1Vw=' $ XPATH=/config/devices/entry/vsys/entry/zone $ HOST=172.29.9.253 $ curl -k " https://$HOST/api/?type=config&action=show&key=$KEY&xpath=$XPATH " you could try to tail these logs while performing the request to see if anything useful shows up. I would log a case if something obvious isn't seen. mp-log ms.log mp-log php.debug.log mp-log appWeb.log webserver-log error.log

ksteves1 · ‎05-26-2013

you should be using --data and --data-urlencode vs. --form. URL-encode everything except the key= parameter. also see https://live.paloaltonetworks.com/message/16433#16433 . that will work with either the Perl or Python panxapi program.

ksteves1 · ‎05-22-2013

you can run: > tail follow yes mp-log authd.log and try your request to see if there is any information that may show the issue. ms.log, php.debug.log and appWeb.log can also have useful information when debugging API usage.

ksteves1 · ‎04-27-2013

Using a panxapi program from either PAN-perl or PAN-python (on DevCenter) you can clone parts of a config from one device to another. In this example I clone a mgt-config user. See doc/panxapi.html from PAN-python. There are a lot of options, and you'll need to invest some time to understand various config XPaths. $ panxapi.py -t pa-200-a -sxr "/config/mgt-config/users/entry[@name='ksteves']" >X.xml show: success $ panxapi.py -t pa-200-b -S X.xml "/config/mgt-config/users" set: success $ panxapi.py -t pa-200-b -Xjro 'show jobs id "397"' op: success { "job": { "details": { "line": "Configuration committed successfully" }, "id": "397", "progress": "12:24:18", "result": "OK", "status": "FIN", "stoppable": false, "tenq": "2013/04/27 12:23:29", "tfin": "12:24:18", "type": "Commit", "user": "admin", "warnings": null } }

ksteves1 · ‎03-26-2013

thanks. I used a reporting template system to build something similar. using PAN-python and PAN-ksteves and with the jsont/threats.jsont template below you can do something like this: $ panxapi.py -t pa-200 -rxg /config/predefined/threats| > panconf.py --config - --json| > panjsont.py --jt threats.jsont --json - get: success phone-home 10585 "CIA_1_22 Get password" data-theft high alert phone-home 10313 "Ezula_Toptext Popup" adware low alert phone-home 10328 "FeRAT_1" adware high alert phone-home 10373 "Wintective_Keylogger" keylogger high alert phone-home 10046 "Scar User-Agent Traffic" spyware medium alert phone-home 10522 "SearchBossToolbar" adware low alert phone-home 10223 "FunBuddyIcons View Fub Buddy icons" browser-hijack low alert phone-home 10286 "Virtumonde info post" adware low alert phone-home 10353 "Opwin_Trojan_1_1 connection and action commands:" adware high alert phone-home 10766 "Hornet_1_0 fetch processes list" adware high alert ... ........................................................................ {# $Id: threats.jsont,v 1.1 2012/08/07 00:17:30 stevesk Exp $ } {# use output from: $ panxapi -rxg /config/predefined/threats} {.section threats} {.section phone-home} {.repeated section entry} phone-home {name} "{threatname}" {category} {severity} {default-action} {.end} {.end} {.section scan} {.repeated section entry} scan {id} "{name}" {severity} {.end} {.end} {.section vulnerability} {.repeated section entry} vulnerability {name} "{threatname}" {category} {severity} {.default-action?}{default-action}{.or}_no-default-action_{.end} {.end} {.end} {.end}

ksteves1 · ‎03-09-2013

There is a program called 'panto.py' in the PAN-ksteves package ( https://live.paloaltonetworks.com/docs/DOC-3533 ) that can assist with Panorama migration. It uses a panxapi program from either PAN-perl ( https://live.paloaltonetworks.com/docs/DOC-1910 ) or PAN-python ( https://live.paloaltonetworks.com/docs/DOC-4762 ) to do the migration tasks using the XML API. If for example you wanted to migrate address object, groups, security and nat rulebase your input file to panto.py could be something like: set panxapi-program panxapi.py set panxapi-from-tag pa-2020 set panxapi-to-tag panorama setvar CONFIG_VSYS '/config/devices/entry/vsys/entry' setvar DEVICE_GROUP 'finance-dg' migrate from-xpath $CONFIG_VSYS/address to-xpath-device-group $DEVICE_GROUP migrate from-xpath $CONFIG_VSYS/address-group to-xpath-device-group $DEVICE_GROUP migrate from-xpath $CONFIG_VSYS/rulebase/security to-xpath-device-group $DEVICE_GROUP pre-rulebase migrate from-xpath $CONFIG_VSYS/rulebase/nat to-xpath-device-group $DEVICE_GROUP post-rulebase and the panto.py program would create the panxapi commands to show and delete the configuration on PAN-OS, and set the configuration on Panorama.

Date Registered	‎04-06-2011 02:46 PM
Date Last Visited	Wednesday
Total Messages Posted	66
Total Likes Received	21

Online Status	Offline
Date Last Visited	Wednesday

Strata

Prisma

Cortex

About ksteves1