Getting Palo Alto firewall rules into splunk

[dgosselin]

I'm looking to get a list of firewall rules from Panorama into splunk to be able to query against traffic logs, is there any way to do this through the Palo Alto app for splunk?

[mnatkin_splunk]

< disclaimer > I haven't yet had the chance to test this on a live system, so YMMV < /disclaimer >

The way I know of to pull the rules is via the PAN-OS XML API. You'll want to use the Xpath parameter to target just the rule base itself, so Xpath=/config/devices/entry/vsys/entry/rulebase/security should do the trick.

Your API call will look something like this:

https://{PANORAMA_IP_or_HOST}/api/?type=config&action=show&key=apikey&xpath=/config/devices/entry/vs...

You're most interested in the "Rule Name" field, as my understanding is that this is the unique identifier in the traffic log that you can correlate against.

For more information, reference the PAN API usage guide (available here): https://www.paloaltonetworks.com/documentation/71/pan-os/xml-api

Good luck, and Happy Splunking!