Palo Alto Networks Panorama v3.0.0

About the connector

The Palo Alto Networks Panorama connector integrates with the Palo Alto Networks® Panorama and supports containment actions such as blocking URLs or IP addresses on the devices configured on Panorama.

This document provides information about the Palo Alto Networks Panorama connector, which facilitates automated interactions with Palo Alto Networks® Panorama using FortiSOAR™ playbooks. Add the Palo Alto Networks Panorama connector as a step in FortiSOAR™ playbooks and perform automated operations, such as blocking or unblocking URLs, IP addresses, or applications that you have specified and retrieving a list of connected firewalls from Panorama.

Version information

Connector Version: 3.0.0

Authored By: Community

Certified: No

Release Notes for version 3.0.0

Following enhancements have been made to the Palo Alto Networks Panorama connector in version 3.0.0:

• Added new configuration parameters 'Device Group Name', 'Rule Type', and 'Verify SSL'

• Updated the following configuration parameters to be optional:

  • Security Policy Name For Blocking URL

  • URL Group

  • Security Policy Name For Blocking Application

  • Application Group.

• Fixed a bug with the 'Block URL' and 'Unblock URL' actions, which were failing if an invalid or unexpected action was specified.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root user to install connectors from an SSH session:

yum install cyops-connector-palo-alto-networks-panorama

Prerequisites to configuring the connector

• You must have the URL of the Palo Alto Networks® Panorama server to which you will connect and perform automated operations and credentials to access that server.
• The FortiSOAR™ server should have outbound connectivity to port 443 for Palo Alto Networks.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Palo Alto Networks Panorama connector card. On the connector popup, click the Configurations tab to enter the required configuration details.

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations:

operation: Block IP

Input parameters

Output

The output contains a non-dictionary value.

operation: Unblock IP

Input parameters

Output

The output contains a non-dictionary value.

operation: Block URL

Input parameters

Output

The output contains a non-dictionary value.

operation: Unblock URL

Input parameters

Output

The output contains a non-dictionary value.

operation: Block Application

Input parameters

Output

The output contains a non-dictionary value.

operation: Unblock Application

Input parameters

Output

The output contains a non-dictionary value.

operation: Get Connected Firewalls

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"response": {
"result": {
"devices": {
"entry": {
"vsys": {
"entry": {
"@name": "",
"display-name": "",
"shared-policy-md5sum": "",
"shared-policy-status": ""
}
},
"sw-version": "",
"unsupported-version": "",
"custom-certificate-usage": "",
"connected-at": "",
"multi-vsys": "",
"av-version": "",
"vpn-disable-mode": "",
"certificate-status": "",
"threat-version": "",
"domain": "",
"hostname": "",
"connected": "",
"global-protect-client-package-version": "",
"logdb-version": "",
"model": "",
"certificate-subject-name": "",
"deactivated": "",
"wildfire-version": "",
"certificate-expiry": "",
"url-filtering-version": "",
"ip-address": "",
"serial": "",
"@name": "",
"url-db": "",
"operational-mode": "",
"family": "",
"app-version": "",
"uptime": ""
}
}
},
"@status": ""
}
}

operation: Get Device Groups

Input parameters

Output

The output contains the following populated JSON schema:
{
"response": {
"result": {
"@total-count": "",
"@count": "",
"device-group": {
"entry": {
"address-group": {
"entry": {
"@name": "",
"static": {
"member": [
{
"#text": "",
"@time": "",
"@dirtyId": "",
"@admin": ""
}
],
"@time": "",
"@dirtyId": "",
"@admin": ""
},
"@time": "",
"@dirtyId": "",
"@admin": ""
},
"@time": "",
"@dirtyId": "",
"@admin": ""
},
"address": {
"entry": [
{
"@name": "",
"ip-netmask": ""
}
],
"@time": "",
"@dirtyId": "",
"@admin": ""
},
"devices": {
"entry": {
"@name": ""
}
},
"profiles": {
"url-filtering": {
"entry": {
"action": "",
"@name": "",
"credential-enforcement": {
"mode": {
"disabled": ""
},
"log-severity": ""
},
"description": "",
"block-list": {
"member": []
}
}
}
},
"@admin": "",
"@name": "",
"@time": "",
"application-group": "",
"@dirtyId": ""
},
"@time": "",
"@dirtyId": "",
"@admin": ""
}
},
"@code": "",
"@status": ""
}
}

operation: Get Application Groups

Input parameters

Output

The output contains the following populated JSON schema:
{
"response": {
"result": {
"@total-count": "",
"application-group": {
"entry": {
"members": {
"member": [
{
"#text": "",
"@time": "",
"@dirtyId": "",
"@admin": ""
},
{
"#text": "",
"@time": "",
"@dirtyId": "",
"@admin": ""
}
],
"@time": "",
"@dirtyId": "",
"@admin": ""
},
"@name": "",
"@time": "",
"@dirtyId": "",
"@admin": ""
},
"@time": "",
"@dirtyId": "",
"@admin": ""
},
"@count": ""
},
"@code": "",
"@status": ""
}
}

Included playbooks

The Sample - Palo Alto Networks Panorama - 3.0.0 playbook collection comes bundled with the Palo Alto Networks Panorama connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Palo Alto Networks Panorama connector.

• Block Application
• Block IP
• Block URL
• Get Application Groups
• Get Connected Firewalls
• Get Device Groups
• Unblock Application
• Unblock IP
• Unblock URL

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.