openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Audit API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Audit
  description: Audit and management log retrieval.
paths:
  /audit/get_audit_management_logs:
    post:
      operationId: getAuditManagementLogs
      summary: Palo Alto Networks Get Audit Management Logs
      description: Retrieves audit management logs recording administrative actions performed in the Cortex XDR console. Includes user logins, policy changes, and configuration modifications.
      tags:
      - Audit
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                request_data:
                  type: object
                  properties:
                    filters:
                      type: array
                      items:
                        $ref: '#/components/schemas/Filter'
                    search_from:
                      type: integer
                      default: 0
                    search_to:
                      type: integer
                      default: 100
                    sort:
                      $ref: '#/components/schemas/SortOrder'
            examples:
              GetAuditManagementLogsRequestExample:
                summary: Default getAuditManagementLogs request
                x-microcks-default: true
                value:
                  request_data:
                    filters:
                    - field: example-field
                      operator: lte
                      value: example-value
                    - field: example-field
                      operator: lte
                      value: example-value
                    search_from: 0
                    search_to: 100
                    sort:
                      field: example-field
                      keyword: asc
      responses:
        '200':
          description: Audit management logs returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      total_count:
                        type: integer
                      result_count:
                        type: integer
                      data:
                        type: array
                        items:
                          $ref: '#/components/schemas/AuditLog'
              examples:
                GetAuditManagementLogs200Example:
                  summary: Default getAuditManagementLogs 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      total_count: 974
                      result_count: 325
                      data:
                      - timestamp: 1725583298090
                        actor_primary_username: jsmith
                        actor_email: example-actor_email
                        actor_type: API
                        sub_type: custom
                        result: FAIL
                        reason: Incident investigation threat Security malware applied detected.
                        ip: 10.144.244.59
                        description: Firewall activity alert investigation alert on detected threat network.
                      - timestamp: 1725583298090
                        actor_primary_username: jsmith
                        actor_email: example-actor_email
                        actor_type: API
                        sub_type: custom
                        result: FAIL
                        reason: Incident investigation threat Security malware applied detected.
                        ip: 10.144.244.59
                        description: Firewall activity alert investigation alert on detected threat network.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /audits/management_logs/get_management_logs:
    post:
      operationId: getManagementLogs
      summary: Palo Alto Networks Get Audit Management Logs
      description: Retrieves audit management logs recording administrative actions performed in the XSIAM console, including user logins, policy changes, data source configuration, and API key management.
      tags:
      - Audit
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                request_data:
                  type: object
                  properties:
                    filters:
                      type: array
                      items:
                        $ref: '#/components/schemas/Filter_3'
                    search_from:
                      type: integer
                      default: 0
                    search_to:
                      type: integer
                      default: 100
                    sort:
                      $ref: '#/components/schemas/SortOrder_3'
            examples:
              GetManagementLogsRequestExample:
                summary: Default getManagementLogs request
                x-microcks-default: true
                value:
                  request_data:
                    filters:
                    - field: example-field
                      operator: eq
                      value: example-value
                    search_from: 0
                    search_to: 100
                    sort:
                      field: example-field
                      keyword: desc
      responses:
        '200':
          description: Management logs returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      total_count:
                        type: integer
                      result_count:
                        type: integer
                      data:
                        type: array
                        items:
                          $ref: '#/components/schemas/AuditLog_3'
              examples:
                GetManagementLogs200Example:
                  summary: Default getManagementLogs 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      total_count: 883
                      result_count: 794
                      data:
                      - timestamp: 1744173019855
                        actor_primary_username: soc-analyst
                        actor_email: example-actor_email
                        actor_type: User
                        sub_type: custom
                        result: FAIL
                        reason: Suspicious investigation alert traffic detected violation alert configured threat Security.
                        ip: 10.224.166.122
                        description: Violation firewall firewall detected incident endpoint policy.
                      - timestamp: 1744173019855
                        actor_primary_username: soc-analyst
                        actor_email: example-actor_email
                        actor_type: User
                        sub_type: custom
                        result: FAIL
                        reason: Suspicious investigation alert traffic detected violation alert configured threat Security.
                        ip: 10.224.166.122
                        description: Violation firewall firewall detected incident endpoint policy.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    Filter:
      type: object
      description: A filter criterion for querying XDR resources.
      required:
      - field
      - operator
      - value
      properties:
        field:
          type: string
          description: Field name to filter on (e.g., incident_id, status, severity).
          example: example-field
        operator:
          type: string
          enum:
          - in
          - contains
          - gte
          - lte
          - eq
          - neq
          description: Comparison operator.
          example: lte
        value:
          description: Filter value. Use an array for the "in" operator, a string or integer for others.
          oneOf:
          - type: string
          - type: integer
          - type: array
            items:
              oneOf:
              - type: string
              - type: integer
          example: example-value
    AuditLog:
      type: object
      description: An audit management log entry recording an administrative action.
      properties:
        timestamp:
          type: integer
          description: Action timestamp as Unix epoch milliseconds.
          example: 1725583298090
        actor_primary_username:
          type: string
          description: Username of the administrator who performed the action.
          example: jsmith
        actor_email:
          type: string
          example: example-actor_email
        actor_type:
          type: string
          enum:
          - User
          - API
          example: API
        sub_type:
          type: string
          description: Action subtype (e.g., Login, Logout, Policy Update).
          example: custom
        result:
          type: string
          enum:
          - SUCCESS
          - FAIL
          example: FAIL
        reason:
          type: string
          description: Failure reason if result is FAIL.
          example: Incident investigation threat Security malware applied detected.
        ip:
          type: string
          description: Source IP address of the action.
          example: 10.144.244.59
        description:
          type: string
          example: Firewall activity alert investigation alert on detected threat network.
    ErrorResponse:
      type: object
      properties:
        reply:
          type: object
          properties:
            err_code:
              type: integer
              example: 782
            err_msg:
              type: string
              example: example-err_msg
            err_extra:
              type: string
              example: example-err_extra
          example:
            err_code: 270
            err_msg: example-err_msg
            err_extra: example-err_extra
    Filter_3:
      type: object
      description: A filter criterion for querying XSIAM resources.
      required:
      - field
      - operator
      - value
      properties:
        field:
          type: string
          description: Field name to filter on.
          example: example-field
        operator:
          type: string
          enum:
          - in
          - contains
          - gte
          - lte
          - eq
          - neq
          example: eq
        value:
          description: Filter value (string, integer, or array for the "in" operator).
          oneOf:
          - type: string
          - type: integer
          - type: array
            items:
              oneOf:
              - type: string
              - type: integer
          example: example-value
    AuditLog_3:
      type: object
      description: An audit management log entry recording an administrative action.
      properties:
        timestamp:
          type: integer
          description: Action timestamp as Unix epoch milliseconds.
          example: 1744173019855
        actor_primary_username:
          type: string
          example: soc-analyst
        actor_email:
          type: string
          example: example-actor_email
        actor_type:
          type: string
          enum:
          - User
          - API
          example: User
        sub_type:
          type: string
          description: Action subtype (e.g., Login, PolicyUpdate, DatasourceCreate).
          example: custom
        result:
          type: string
          enum:
          - SUCCESS
          - FAIL
          example: FAIL
        reason:
          type: string
          example: Suspicious investigation alert traffic detected violation alert configured threat Security.
        ip:
          type: string
          example: 10.224.166.122
        description:
          type: string
          example: Violation firewall firewall detected incident endpoint policy.
    SortOrder_3:
      type: object
      description: Sorting specification for result sets.
      properties:
        field:
          type: string
          example: example-field
        keyword:
          type: string
          enum:
          - asc
          - desc
          example: desc
    SortOrder:
      type: object
      description: Sorting specification for result sets.
      properties:
        field:
          type: string
          description: Field to sort by.
          example: example-field
        keyword:
          type: string
          enum:
          - asc
          - desc
          description: Sort direction.
          example: asc
  responses:
    Forbidden:
      description: Insufficient permissions for the requested operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid authentication headers.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request body or invalid parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.