What permissions are required on the firewall for the account that Splunk for Palo Alto Networks uses?

[ubnt_bane]

What permissions are required on the firewall for the account that Splunk for Palo Alto Network uses?

[shirishkamat84]

as per the document from developer, the account needs the below xml api privileges.

Feature Permission Needed
Commands: pantag, panuserupdate User-ID Agent
Alert Action - Tag to Dynamic Address List User-ID Agent
Command: pancontentpack with PAN-OS < 8.0 Configuration
Command: pancontentpack with PAN-OS >= 8.0 Configuration and Operational Requests

https://splunk.paloaltonetworks.com/adaptive-response.html

[itradeclayton]

I'm looking for this answer too. Did you ever find it?

[shirishkamat84]

can you please explain what you are trying to do, based on that we can answer the access problem. I followed the steps mentioned in the document and was able to configure the TA with firewall\panorama.