OK, in case anyone would like the solution to this. I was looking in the wrong direction. When you are working with Panorama, it is the Devices->Device-Group path. Below is for the Global Device Group. To get the application-tag: &action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Global']/application-tag/entry[@name='ssh']/tag And to edit the application-tag: &action=edit&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Global']/application-tag/entry[@name='100bao']/tag/member&element=<member>Sanctioned</member> Using the tag "empty" you can clear the tag, but strangely enough, it sets the "Remove Tag Inheritance" flag. Anyone know why it does that? action=edit&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Global']/application-tag/entry[@name='100bao']/tag/member&element=<member>empty</member>
... View more