About tschlottog

Ahhh, that works.  No worries.   Edit will replace everything at that element/tag with whatever you input.  So if you have multiple zones in the Source Zone and do an edit, it will nuke everything and drop your new zone in leaving you with an odd configuration.  If you've only got single zones in your rule, this shouldn't be too much of an issue, but it is something akin to using a chainsaw to perform leg surgery.   Rename is to do just that, rename an object.  Instead of objectA you want to name it ObjectA, you would use rename to get it done.  You wouldn't be renaming an object, unless you simply wanted to take ZoneA and rename it to ZoneA_old.  In that case, you would be on track with the rename action.   Otherwise the Add/Remove process is what you are going to be looking for, it'll allow you to carve out and readd what you are looking for in process. ... View more

Milos, you are going to need to alter your action from 'action=show' to 'action=set' to get it to add in the new zone and then an 'action=delete' in order to remove the old zone.  You should be able to do this programatically through some offbox scripting as well.  I've automated changes like this before and broke them down in 3 discrete stages.   1.  Discovery - Pull down the configuration from Panorama then roll through the XML using something like Element Tree in order to find all the rules that match the source zone or whatever XML tag I am looking for and create a list to be used. 2.  Addition - With the created list, sequentially roll through the rules creating targeted additions to the rules with the 'action=set' as part of the URI.  Monitor for any errors at this stage, if you catch anything other than HTTP 200 responses, stop the entire process and take a look at what is going on. 3.  Clean Up - With the same list we used in Addition, go through and with an 'action=delete' removing your old source zone or tag.   At this point you have a candidate configuration and will need to commit it in order to complete your change.  This is a good time to run a config diff between your candidate and running configuration to make sure that you are visually seeing the changes that you want to see.  If you are good with it, go ahead with the commit.  Once you are comfortable with the actions in your script, you can automate the commit process as well, but it is something I typically leave for the end game of the development process given the potential for issues while creating this process. ... View more

Kevin, I've done this before with MS-ISAC and it can absolutely be done.  One thing to note though is that MS-ISAC recently moved from Soltra Edge to utilizing Anomali.  They also just recently enabled the TAXII feeds on the Anomali side.  I am working on doing discovery and integration now to get that operational.  Basically it breaks down into a couple of steps.   1.  Clone an existing TAXII prototype (hailataxii is the easiest) and input the necessary components (taxii-discovery-service, feed, etc). 2.  Make sure that your initial load looks back at least 7 days if not longer to make sure you get some data.  It is important to note that the feed starts the moment you start the node, there isn't anything rearward looking unless you configure it as such. 3.  Create the miner/node associated with the prototype and put in your authentication credentials here.  You can do it in the prototype as well, but it really isn't necessary. 4.  Utilize your miner/node in the feed.   Things to point out are to make sure that you are using the correct discovery service URL and that your credentials are correct.  It will take a little time to pull in and parse the data.  Be patient, if you have authenticated appropriately you should have little issue.  When in doubt utilize the CLI test commands on your VM in order to make sure it's going. ... View more

I think your XPath for the object may be a bit off.   Original: /config/devices/entry/vsys/entry[@name='vsys1']/p rofiles/custom-url-category/entry[@name='Blocklist - Mine']/member[text()='pufikshop.ru/css/index.php']   New: /config/devices/entry/vsys/entry[@name='vsys1']/profiles/custom-url-category/entry[@name='Blocklist - Mine']/list/member[text()='pufikshop.ru/css/index.php'] ... View more

If you are looking how to structure your commands, you can connect to the API browser on your firewall directly with https://<Your FW IP>/api which will take you right in.  From there you should be able to dig out what you need.  If you have the portions you need, you can either script it straight out with PanPy fairly easily and quickly. ... View more