msmithsec/xsoar-automatic-slr

Use the Palo Alto Networks NGFW API to automatically generate a Security Lifecycle Review (SLR) Report.

Configure Automatic SLR on XSOAR

Navigate to Settings > Integrations > Utilities.
Search for "Palo Alto Networks Automatic SLR (Community).

Click Add instance to create and configure a new integration instance.

Parameter	Description
Name	A meaningful name for the integration instance.
Firewall FQDN/IP	Management FQDN or IP address of the firewall
Firewall TCP Port	Management Port (Default: `443`) of the firewall
Firewall API Key	API Key for the target firewall
Firewall Timeout	Timeout value in seconds for API operations (Default: `300`)
Verify Firewall Certificate	Verify the SSL/TLS Certificate the firewall presents
CSP API Key	The API Key for the Palo Alto Networks Customer Support Portal (CSP)
CSP Timeout	Timeout value in seconds for API operations (Default: `300`)
Verify CSP Certificate	Verify the SSL/TLS Certificate for the CSP
XSOAR System Proxy	Enable if XSOAR utilises a proxy
Enable Verbose Output	Enables debug/verbose output to the war room
Customer Account Name	Name of organisation to appear on the SLR Report
Firewall Deployment Location	Select the logicial deployment location of the firewall
Deployment Country	Set the country the customer/firewall resides in
Deployment Geographic Region	Select the geographic region the customer/firewall resides in
Customer Industry	Select the industry the customer is in
Language	Select the language for the report to be generated in
Prepared By	Set the name of the person who generated the report
Requested By	Set the email address of the person who generated the report
Send To	Set the email address of the receipient who will receive the report

Click Test to validate integration can communicate with the firewall.

NOTE: The test command does not function when Enable Verbose Output is set to enabled/true.

Step-by-step configuration

This section will cover how to retrieve the Palo Alto Networks Customer Support Portal (CSP) and PAN-OS API key's

Firewall API Key

A firewall "Super User" or administrator with a custom "Admin Role" limiting their interaction with the API is required to complete these steps.

This integration requires an API Key for the target firewall in order to run the neccesary API commands. In order to retireve that API Key either:

Run this command from a terminal, replacing <firewall>, <username> and <password> as needed -

curl -k -X GET 'https://<firewall>/api/?type=keygen&user=<username>&password=<password>'

curl -k -X POST 'https://<firewall>/api/?type=keygen&user=<username>&password=<password>'

Alternatively, open a browser window and navigate to: https://<firewall>/api/?type=keygen&user=<username>&password=<password>

<response status="success"> 
    <result> 
        <key>gJlQWE56987nBxIqyfa62sZeRtYuIo2BgzEA9UOnlZBhU</key> 
    </result> 
</response>

Reference Material

How-to generate an API Key: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/get-your-api-key.html

Customer Support Portal (CSP) API Key

A Customer Support Portal "Super User" is required to complete these steps.

Ensure you have the "Super User" role assigned to your account by logging in to the CSP, then navigating to: Support Home > Members > Manage Users Under the "Roles" column you should have "Super User" assigned.
Once you have the correct role assigned to your user, navigate to: Support Home > Assets > Licensing API
If a key already exists, it will be displayed to you. We will use this key in the integration configuration.
If a key does exist, click Generate to generate a new API key

NOTE: Pay attention to the expiry date and extend/regenerate the key as neccesary.

Reference Material

Customer Support Portal Roles: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaTCAS How-to Generate the API Key: https://docs.paloaltonetworks.com/vm-series/10-0/vm-series-deployment/license-the-vm-series-firewall/licensing-api/manage-the-licensing-api-key.html

Commands

You can execute these commands from the Demisto CLI or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Dump Integration Parameters

In some circumstances, it may be required to get visbility of all currently configured parameters dumped to the context for troubleshooting.

Base Command

!autoslr-dump-params

Arguments

There are no input arguments for this command.

Context Output

Context Key	Description	Type
AutoSLR.params.csp_host	The CSP base URL	String
AutoSLR.params.csp_proxy	Enable/disable system proxy for CSP communications	Boolean
AutoSLR.params.csp_timeout	The timeout value for CSP API operations	Integer
AutoSLR.params.csp_tls_verify	Enable/disable TLS verification for the CSP	Boolean
AutoSLR.params.csp_verbose	Enable/disable verbose output for CSP operations	Boolean
AutoSLR.params.ngfw_host	The firewall base URL	String
AutoSLR.params.ngfw_port	The firewall TCP port	Integer
AutoSLR.params.ngfw_proxy	Enable/disable system proxy for NGFW communications	Boolean
AutoSLR.params.ngfw_timeout	The timeout value for NGFW API operations	Integer
AutoSLR.params.ngfw_tls_verify	Enable/disable TLS verification for the CSP	Boolean
AutoSLR.params.ngfw_verbose	Enable/disable verbose output for CSP operations	Boolean
AutoSLR.params.slr_account_name	The account name to appear on the SLR report	String
AutoSLR.params.slr_country	The deployment country of the firewall	String
AutoSLR.params.slr_deployment_location	The logical deployment location of the firewall	String
AutoSLR.params.slr_geographic_region	The geographic region the firewall is deployed in	String
AutoSLR.params.slr_industry	The industry of the customer organisation	String
AutoSLR.params.slr_language	The language the report should be generated in	String
AutoSLR.params.slr_prepared_by	The name of the person who generated the report	String
AutoSLR.params.slr_requested_by	The email address of the person who generated the report	String
AutoSLR.params.slr_send_to	The email address of the receipient of the report	String
AutoSLR.params.system_proxy	Global enable/disable the use of the system proxy	String
AutoSLR.params.system_verbose	Global enable/disable the verbose/debugging output	String

Retrieve "show system info" Output

This command will retrieve certain information about the target firewall for use within other functions.

Base Command

!autoslr-ngfw-system-info

Arguments

There are no input arguments for this command.

Context Output

Context Key	Description	Type
AutoSLR.ngfw_system_info.hostname	The hostname of the target firewall	String
AutoSLR.ngfw_system_info.serial	The serial number of the target firewall	String
AutoSLR.ngfw_system_info.software	The PAN-OS software version of the target firewall	String

Initiate SLR Generation

This command will initiate the *-stats_dump.tar.gz generation job on the target firewall

Base Command

!autoslr-ngfw-generate

Arguments

There are no input arguments for this command.

Context Output

Context Key	Description	Type
AutoSLR.generate.job_id	The Job ID of the generation task	Integer

Check SLR Generation Status

This command will check the *-stats_dump.tar.gz generation job on the target firewall

Base Command

!autoslr-ngfw-check

Arguments

Argument	Description	Type
job_id	The Job ID of the generation task	Integer

Context Output

Context Key	Description	Type
AutoSLR.generate.job_status	The Job status of the generation task	Boolean

Download *-stats_dump.tar.gz from the firewall

This command will download the *-stats_dump.tar.gz from the target firewall

Base Command

!autoslr-ngfw-download

Arguments

Argument	Description	Type
job_id	The Job ID of the generation task	Integer

Context Output

Context Key	Description	Type
AutoSLR.generate.file_name	The human readable filename of the downloaded file	String
InfoFile.EntryID	The EntryID of the downloaded file	String

Note: In the default playbook supplied with the content pack, InfoFile.EntryID is copied to AutoSLR.generate.EntryID for use in the upload function.

Upload *-stats_dump.tar.gz to Palo Alto Networks

This command will upload the *-stats_dump.tar.gz file to Palo Alto Networks for report generation

Base Command

!autoslr-csp-upload

Arguments

Argument	Description	Type
input_file	The EntryID of the file to upload	String

Context Output

Context Key	Description	Type
AutoSLR.upload.id	The SLR Reference ID returned by the CSP API	String
AutoSLR.upload.send_to	The email address the completed report will be sent to	String

msmithsec / xsoar-automatic-slr

Configure Automatic SLR on XSOAR

Step-by-step configuration

Firewall API Key

Reference Material

Customer Support Portal (CSP) API Key

Reference Material

Commands

Dump Integration Parameters

Base Command

Arguments

Context Output

Retrieve "show system info" Output

Base Command

Arguments

Context Output

Initiate SLR Generation

Base Command

Arguments

Context Output

Check SLR Generation Status

Base Command

Arguments

Context Output

Download *-stats_dump.tar.gz from the firewall

Base Command

Arguments

Context Output

Upload *-stats_dump.tar.gz to Palo Alto Networks

Base Command

Arguments

Context Output

About

Languages