openapi: 3.1.0 info: title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend SecurityRules API description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform. version: '1.0' contact: name: Palo Alto Networks Developer Support url: https://pan.dev/ license: name: Proprietary url: https://www.paloaltonetworks.com/legal servers: - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1 description: AIOps for NGFW BPA API production server. security: - oauth2Bearer: [] tags: - name: SecurityRules description: Security rules within rule stacks. paths: /config/rulestacks/{rulestack}/security-rules: get: operationId: listSecurityRules summary: Palo Alto Networks List Security Rules description: Returns all security rules in the specified rule stack. Security rules are evaluated in priority order and define traffic inspection and forwarding policy for the Cloud NGFW. tags: - SecurityRules parameters: - $ref: '#/components/parameters/rulestack' - name: maxresults in: query description: Maximum number of rules to return. schema: type: integer default: 100 example: 100 - name: nexttoken in: query description: Pagination token from a previous response. schema: type: string example: example-nexttoken - name: listtype in: query description: Whether to return candidate or running configuration. schema: type: string enum: - CANDIDATE - RUNNING default: CANDIDATE example: CANDIDATE responses: '200': description: Security rules returned successfully. content: application/json: schema: type: object properties: Response: type: object properties: RuleListCandidate: type: array items: $ref: '#/components/schemas/SecurityRuleSummary' NextToken: type: string ResponseStatus: $ref: '#/components/schemas/ResponseStatus' examples: ListSecurityRules200Example: summary: Default listSecurityRules 200 response x-microcks-default: true value: Response: RuleListCandidate: - Priority: 234 RuleName: Production Policy 12 Enabled: false NextToken: example-NextToken ResponseStatus: ErrorCode: 0 Reason: '' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK post: operationId: createSecurityRule summary: Palo Alto Networks Create Security Rule description: Creates a new security rule in the rule stack at the specified priority. Rules with lower priority numbers are evaluated first. Define source and destination criteria, applications, and the enforcement action. tags: - SecurityRules parameters: - $ref: '#/components/parameters/rulestack' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SecurityRuleRequest' examples: CreateSecurityRuleRequestExample: summary: Default createSecurityRule request x-microcks-default: true value: Priority: 48316 RuleEntry: RuleName: Primary Gateway 01 Description: Activity Security blocked suspicious threat alert activity firewall. Enabled: true Source: Cidrs: - example-Cidrs_item Countries: - example-Countries_item Feeds: - example-Feeds_item - example-Feeds_item PrefixLists: - example-PrefixLists_item - example-PrefixLists_item Destination: Cidrs: - example-Cidrs_item - example-Cidrs_item Countries: - example-Countries_item - example-Countries_item Feeds: - example-Feeds_item FqdnLists: - example-FqdnLists_item - example-FqdnLists_item PrefixLists: - example-PrefixLists_item Applications: - ssh Protocol: APPLICATION-DEFAULT Action: DenySilent responses: '200': description: Security rule created successfully. content: application/json: schema: type: object properties: Response: $ref: '#/components/schemas/SecurityRule' ResponseStatus: $ref: '#/components/schemas/ResponseStatus' examples: CreateSecurityRule200Example: summary: Default createSecurityRule 200 response x-microcks-default: true value: Response: Priority: 707 RuleEntry: RuleName: Primary Gateway 01 Description: Firewall alert incident monitoring investigation threat threat blocked activity monitoring. Enabled: true Source: Cidrs: - example-Cidrs_item - example-Cidrs_item Countries: - example-Countries_item - example-Countries_item Feeds: - example-Feeds_item PrefixLists: - example-PrefixLists_item NegateSource: false Destination: Cidrs: - example-Cidrs_item Countries: - example-Countries_item - example-Countries_item Feeds: - example-Feeds_item FqdnLists: - example-FqdnLists_item - example-FqdnLists_item PrefixLists: - example-PrefixLists_item NegateDestination: false Applications: - dns - web-browsing Category: URLCategoryNames: - Production Sensor 06 Feeds: - example-Feeds_item Protocol: UDP Action: Allow DecryptionRuleType: SSLOutboundInspection AuditComment: Rule malware monitoring malware firewall violation suspicious detected applied firewall detected applied. ResponseStatus: ErrorCode: 0 Reason: '' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '409': $ref: '#/components/responses/Conflict' x-microcks-operation: delay: 0 dispatcher: FALLBACK /config/rulestacks/{rulestack}/security-rules/{priority}: get: operationId: getSecurityRule summary: Palo Alto Networks Get Security Rule description: Returns a specific security rule by its priority number within the rule stack. tags: - SecurityRules parameters: - $ref: '#/components/parameters/rulestack' - $ref: '#/components/parameters/priority' - name: candidate in: query description: Return candidate configuration if true, running configuration if false. schema: type: boolean default: true example: true responses: '200': description: Security rule returned successfully. content: application/json: schema: type: object properties: Response: $ref: '#/components/schemas/SecurityRule' ResponseStatus: $ref: '#/components/schemas/ResponseStatus' examples: GetSecurityRule200Example: summary: Default getSecurityRule 200 response x-microcks-default: true value: Response: Priority: 707 RuleEntry: RuleName: Primary Gateway 01 Description: Firewall alert incident monitoring investigation threat threat blocked activity monitoring. Enabled: true Source: Cidrs: - example-Cidrs_item - example-Cidrs_item Countries: - example-Countries_item - example-Countries_item Feeds: - example-Feeds_item PrefixLists: - example-PrefixLists_item NegateSource: false Destination: Cidrs: - example-Cidrs_item Countries: - example-Countries_item - example-Countries_item Feeds: - example-Feeds_item FqdnLists: - example-FqdnLists_item - example-FqdnLists_item PrefixLists: - example-PrefixLists_item NegateDestination: false Applications: - dns - web-browsing Category: URLCategoryNames: - Production Sensor 06 Feeds: - example-Feeds_item Protocol: UDP Action: Allow DecryptionRuleType: SSLOutboundInspection AuditComment: Rule malware monitoring malware firewall violation suspicious detected applied firewall detected applied. ResponseStatus: ErrorCode: 0 Reason: '' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK put: operationId: updateSecurityRule summary: Palo Alto Networks Update Security Rule description: Updates an existing security rule at the specified priority in the rule stack. tags: - SecurityRules parameters: - $ref: '#/components/parameters/rulestack' - $ref: '#/components/parameters/priority' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SecurityRuleRequest' examples: UpdateSecurityRuleRequestExample: summary: Default updateSecurityRule request x-microcks-default: true value: Priority: 48316 RuleEntry: RuleName: Primary Gateway 01 Description: Activity Security blocked suspicious threat alert activity firewall. Enabled: true Source: Cidrs: - example-Cidrs_item Countries: - example-Countries_item Feeds: - example-Feeds_item - example-Feeds_item PrefixLists: - example-PrefixLists_item - example-PrefixLists_item Destination: Cidrs: - example-Cidrs_item - example-Cidrs_item Countries: - example-Countries_item - example-Countries_item Feeds: - example-Feeds_item FqdnLists: - example-FqdnLists_item - example-FqdnLists_item PrefixLists: - example-PrefixLists_item Applications: - ssh Protocol: APPLICATION-DEFAULT Action: DenySilent responses: '200': description: Security rule updated successfully. content: application/json: schema: type: object properties: Response: $ref: '#/components/schemas/SecurityRule' ResponseStatus: $ref: '#/components/schemas/ResponseStatus' examples: UpdateSecurityRule200Example: summary: Default updateSecurityRule 200 response x-microcks-default: true value: Response: Priority: 707 RuleEntry: RuleName: Primary Gateway 01 Description: Firewall alert incident monitoring investigation threat threat blocked activity monitoring. Enabled: true Source: Cidrs: - example-Cidrs_item - example-Cidrs_item Countries: - example-Countries_item - example-Countries_item Feeds: - example-Feeds_item PrefixLists: - example-PrefixLists_item NegateSource: false Destination: Cidrs: - example-Cidrs_item Countries: - example-Countries_item - example-Countries_item Feeds: - example-Feeds_item FqdnLists: - example-FqdnLists_item - example-FqdnLists_item PrefixLists: - example-PrefixLists_item NegateDestination: false Applications: - dns - web-browsing Category: URLCategoryNames: - Production Sensor 06 Feeds: - example-Feeds_item Protocol: UDP Action: Allow DecryptionRuleType: SSLOutboundInspection AuditComment: Rule malware monitoring malware firewall violation suspicious detected applied firewall detected applied. ResponseStatus: ErrorCode: 0 Reason: '' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK delete: operationId: deleteSecurityRule summary: Palo Alto Networks Delete Security Rule description: Deletes the security rule at the specified priority from the rule stack. tags: - SecurityRules parameters: - $ref: '#/components/parameters/rulestack' - $ref: '#/components/parameters/priority' responses: '200': description: Security rule deleted successfully. content: application/json: schema: type: object properties: ResponseStatus: $ref: '#/components/schemas/ResponseStatus' examples: DeleteSecurityRule200Example: summary: Default deleteSecurityRule 200 response x-microcks-default: true value: ResponseStatus: ErrorCode: 0 Reason: '' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK /security-rules: get: operationId: listSecurityRules summary: Palo Alto Networks List Security Rules description: Returns a list of security policy rules configured in Prisma Access. Security rules control traffic flowing through the SASE platform by specifying source, destination, application, and action criteria. Rules are evaluated in order from top to bottom. tags: - SecurityRules parameters: - name: folder in: query required: true description: The folder containing the security rules (e.g., Shared, Mobile Users, Remote Networks). schema: type: string example: example-folder - name: position in: query description: Filter by rule position (pre or post). schema: type: string enum: - pre - post example: pre - name: offset in: query schema: type: integer default: 0 example: 0 - name: limit in: query schema: type: integer default: 200 example: 200 responses: '200': description: Security rules returned successfully. content: application/json: schema: type: object properties: data: type: array items: $ref: '#/components/schemas/SecurityRule_2' offset: type: integer total: type: integer limit: type: integer examples: ListSecurityRules200Example: summary: Default listSecurityRules 200 response x-microcks-default: true value: data: - id: example-id name: Branch Policy 74 description: Security incident incident threat violation malware. disabled: false from: &id001 - example-from_item to: &id002 - example-to_item source: &id003 - example-source_item - example-source_item destination: &id004 - example-destination_item source_user: &id005 - example-source_user_item application: &id006 - ssl - dns service: &id007 - example-service_item category: &id008 - custom action: drop profile_setting: &id009 group: - example-group_item log_setting: example-log_setting tag: &id010 - production - critical-asset folder: example-folder position: pre - id: example-id name: Branch Policy 74 description: Security incident incident threat violation malware. disabled: false from: *id001 to: *id002 source: *id003 destination: *id004 source_user: *id005 application: *id006 service: *id007 category: *id008 action: drop profile_setting: *id009 log_setting: example-log_setting tag: *id010 folder: example-folder position: pre offset: 526 total: 263 limit: 721 '400': $ref: '#/components/responses/BadRequest_2' '401': $ref: '#/components/responses/Unauthorized_2' '403': $ref: '#/components/responses/Forbidden' '500': $ref: '#/components/responses/InternalServerError' x-microcks-operation: delay: 0 dispatcher: FALLBACK post: operationId: createSecurityRule summary: Palo Alto Networks Create a Security Rule description: Creates a new security rule in the candidate configuration. Changes must be pushed to take effect. tags: - SecurityRules parameters: - name: folder in: query required: true description: Target folder for the security rule. schema: type: string example: example-folder - name: position in: query description: Position for the new rule (pre or post). schema: type: string enum: - pre - post example: pre requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SecurityRule_2' examples: CreateSecurityRuleRequestExample: summary: Default createSecurityRule request x-microcks-default: true value: id: example-id name: Branch Policy 74 description: Security incident incident threat violation malware. disabled: false from: &id011 - example-from_item to: &id012 - example-to_item source: &id013 - example-source_item - example-source_item destination: &id014 - example-destination_item source_user: &id015 - example-source_user_item application: &id016 - ssl - dns service: &id017 - example-service_item category: &id018 - custom action: drop profile_setting: &id019 group: - example-group_item log_setting: example-log_setting tag: &id020 - production - critical-asset folder: example-folder position: pre responses: '201': description: Security rule created successfully. content: application/json: schema: $ref: '#/components/schemas/SecurityRule_2' examples: CreateSecurityRule201Example: summary: Default createSecurityRule 201 response x-microcks-default: true value: id: example-id name: Branch Policy 74 description: Security incident incident threat violation malware. disabled: false from: *id011 to: *id012 source: *id013 destination: *id014 source_user: *id015 application: *id016 service: *id017 category: *id018 action: drop profile_setting: *id019 log_setting: example-log_setting tag: *id020 folder: example-folder position: pre '400': $ref: '#/components/responses/BadRequest_2' '401': $ref: '#/components/responses/Unauthorized_2' '403': $ref: '#/components/responses/Forbidden' '500': $ref: '#/components/responses/InternalServerError' x-microcks-operation: delay: 0 dispatcher: FALLBACK /security-rules/{id}: get: operationId: getSecurityRule summary: Palo Alto Networks Get a Security Rule description: Returns the configuration of a specific security rule. tags: - SecurityRules parameters: - name: id in: path required: true description: Unique security rule identifier. schema: type: string example: example-id responses: '200': description: Security rule returned successfully. content: application/json: schema: $ref: '#/components/schemas/SecurityRule_2' examples: GetSecurityRule200Example: summary: Default getSecurityRule 200 response x-microcks-default: true value: id: example-id name: Branch Policy 74 description: Security incident incident threat violation malware. disabled: false from: - example-from_item to: - example-to_item source: - example-source_item - example-source_item destination: - example-destination_item source_user: - example-source_user_item application: - ssl - dns service: - example-service_item category: - custom action: drop profile_setting: group: - example-group_item log_setting: example-log_setting tag: - production - critical-asset folder: example-folder position: pre '401': $ref: '#/components/responses/Unauthorized_2' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError' x-microcks-operation: delay: 0 dispatcher: FALLBACK put: operationId: updateSecurityRule summary: Palo Alto Networks Update a Security Rule description: Updates an existing security rule in the candidate configuration. tags: - SecurityRules parameters: - name: id in: path required: true description: Unique security rule identifier. schema: type: string example: example-id requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SecurityRule_2' examples: UpdateSecurityRuleRequestExample: summary: Default updateSecurityRule request x-microcks-default: true value: id: example-id name: Branch Policy 74 description: Security incident incident threat violation malware. disabled: false from: &id021 - example-from_item to: &id022 - example-to_item source: &id023 - example-source_item - example-source_item destination: &id024 - example-destination_item source_user: &id025 - example-source_user_item application: &id026 - ssl - dns service: &id027 - example-service_item category: &id028 - custom action: drop profile_setting: &id029 group: - example-group_item log_setting: example-log_setting tag: &id030 - production - critical-asset folder: example-folder position: pre responses: '200': description: Security rule updated successfully. content: application/json: schema: $ref: '#/components/schemas/SecurityRule_2' examples: UpdateSecurityRule200Example: summary: Default updateSecurityRule 200 response x-microcks-default: true value: id: example-id name: Branch Policy 74 description: Security incident incident threat violation malware. disabled: false from: *id021 to: *id022 source: *id023 destination: *id024 source_user: *id025 application: *id026 service: *id027 category: *id028 action: drop profile_setting: *id029 log_setting: example-log_setting tag: *id030 folder: example-folder position: pre '400': $ref: '#/components/responses/BadRequest_2' '401': $ref: '#/components/responses/Unauthorized_2' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError' x-microcks-operation: delay: 0 dispatcher: FALLBACK delete: operationId: deleteSecurityRule summary: Palo Alto Networks Delete a Security Rule description: Deletes a security rule from the candidate configuration. tags: - SecurityRules parameters: - name: id in: path required: true description: Unique security rule identifier. schema: type: string example: example-id responses: '200': description: Security rule deleted successfully. '401': $ref: '#/components/responses/Unauthorized_2' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError' x-microcks-operation: delay: 0 dispatcher: FALLBACK /sse/config/v1/security-rules: get: operationId: listSecurityRules summary: Palo Alto Networks List Security Rules description: Returns a paginated list of security rules in the specified scope and rulebase position. Security rules define traffic forwarding and inspection policy applied to network traffic through managed firewalls. tags: - SecurityRules parameters: - $ref: '#/components/parameters/folder' - $ref: '#/components/parameters/snippet' - $ref: '#/components/parameters/device' - $ref: '#/components/parameters/position' - $ref: '#/components/parameters/limit' - $ref: '#/components/parameters/offset' - name: name in: query description: Filter by rule name. schema: type: string example: Corporate Sensor 54 responses: '200': description: Security rules returned successfully. content: application/json: schema: $ref: '#/components/schemas/SecurityRuleList' examples: ListSecurityRules200Example: summary: Default listSecurityRules 200 response x-microcks-default: true value: data: - id: 6c72fa83-24c0-4558-897f-a344aa4b1076 name: Branch Firewall 85 folder: example-folder position: post from: &id031 - example-from_item to: &id032 - example-to_item - example-to_item source: &id033 - example-source_item - example-source_item destination: &id034 - example-destination_item - example-destination_item source_user: &id035 - example-source_user_item application: &id036 - ssl service: &id037 - example-service_item - example-service_item category: &id038 - advanced action: reset-both log_setting: example-log_setting profile_setting: &id039 group: - example-group_item - example-group_item disabled: false description: Alert activity firewall malware traffic incident Security configured rule. tag: &id040 - critical-asset - id: 6c72fa83-24c0-4558-897f-a344aa4b1076 name: Branch Firewall 85 folder: example-folder position: post from: *id031 to: *id032 source: *id033 destination: *id034 source_user: *id035 application: *id036 service: *id037 category: *id038 action: reset-both log_setting: example-log_setting profile_setting: *id039 disabled: false description: Alert activity firewall malware traffic incident Security configured rule. tag: *id040 offset: 977 total: 964 limit: 574 '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized_3' '403': $ref: '#/components/responses/Forbidden_2' x-microcks-operation: delay: 0 dispatcher: FALLBACK post: operationId: createSecurityRule summary: Palo Alto Networks Create Security Rule description: Creates a new security rule in the specified folder or snippet at the given rulebase position. The rule defines matching criteria including source and destination zones, addresses, applications, and services. tags: - SecurityRules parameters: - $ref: '#/components/parameters/folder' - $ref: '#/components/parameters/snippet' - $ref: '#/components/parameters/device' - $ref: '#/components/parameters/position' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SecurityRuleRequest_2' examples: CreateSecurityRuleRequestExample: summary: Default createSecurityRule request x-microcks-default: true value: name: Staging Policy 74 from: - any to: - any source: - any destination: - any source_user: - example-source_user_item application: - any service: - application-default category: - standard action: allow log_setting: example-log_setting profile_setting: group: - example-group_item - example-group_item disabled: false description: Threat applied on alert monitoring incident rule on monitoring. tag: - critical-asset - production responses: '201': description: Security rule created successfully. content: application/json: schema: $ref: '#/components/schemas/SecurityRule_3' examples: CreateSecurityRule201Example: summary: Default createSecurityRule 201 response x-microcks-default: true value: id: 6c72fa83-24c0-4558-897f-a344aa4b1076 name: Branch Firewall 85 folder: example-folder position: post from: - example-from_item to: - example-to_item - example-to_item source: - example-source_item - example-source_item destination: - example-destination_item - example-destination_item source_user: - example-source_user_item application: - ssl service: - example-service_item - example-service_item category: - advanced action: reset-both log_setting: example-log_setting profile_setting: group: - example-group_item - example-group_item disabled: false description: Alert activity firewall malware traffic incident Security configured rule. tag: - critical-asset '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized_3' '409': $ref: '#/components/responses/Conflict_2' x-microcks-operation: delay: 0 dispatcher: FALLBACK /sse/config/v1/security-rules/{id}: get: operationId: getSecurityRule summary: Palo Alto Networks Get Security Rule description: Returns a single security rule by its unique identifier. tags: - SecurityRules parameters: - $ref: '#/components/parameters/id' - $ref: '#/components/parameters/position' responses: '200': description: Security rule returned successfully. content: application/json: schema: $ref: '#/components/schemas/SecurityRule_3' examples: GetSecurityRule200Example: summary: Default getSecurityRule 200 response x-microcks-default: true value: id: 6c72fa83-24c0-4558-897f-a344aa4b1076 name: Branch Firewall 85 folder: example-folder position: post from: - example-from_item to: - example-to_item - example-to_item source: - example-source_item - example-source_item destination: - example-destination_item - example-destination_item source_user: - example-source_user_item application: - ssl service: - example-service_item - example-service_item category: - advanced action: reset-both log_setting: example-log_setting profile_setting: group: - example-group_item - example-group_item disabled: false description: Alert activity firewall malware traffic incident Security configured rule. tag: - critical-asset '401': $ref: '#/components/responses/Unauthorized_3' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK put: operationId: updateSecurityRule summary: Palo Alto Networks Update Security Rule description: Updates an existing security rule by its unique identifier. The entire rule object must be provided as this performs a full replacement. tags: - SecurityRules parameters: - $ref: '#/components/parameters/id' - $ref: '#/components/parameters/position' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SecurityRuleRequest_2' examples: UpdateSecurityRuleRequestExample: summary: Default updateSecurityRule request x-microcks-default: true value: name: Staging Policy 74 from: - any to: - any source: - any destination: - any source_user: - example-source_user_item application: - any service: - application-default category: - standard action: allow log_setting: example-log_setting profile_setting: group: - example-group_item - example-group_item disabled: false description: Threat applied on alert monitoring incident rule on monitoring. tag: - critical-asset - production responses: '200': description: Security rule updated successfully. content: application/json: schema: $ref: '#/components/schemas/SecurityRule_3' examples: UpdateSecurityRule200Example: summary: Default updateSecurityRule 200 response x-microcks-default: true value: id: 6c72fa83-24c0-4558-897f-a344aa4b1076 name: Branch Firewall 85 folder: example-folder position: post from: - example-from_item to: - example-to_item - example-to_item source: - example-source_item - example-source_item destination: - example-destination_item - example-destination_item source_user: - example-source_user_item application: - ssl service: - example-service_item - example-service_item category: - advanced action: reset-both log_setting: example-log_setting profile_setting: group: - example-group_item - example-group_item disabled: false description: Alert activity firewall malware traffic incident Security configured rule. tag: - critical-asset '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized_3' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK delete: operationId: deleteSecurityRule summary: Palo Alto Networks Delete Security Rule description: Deletes a security rule by its unique identifier. tags: - SecurityRules parameters: - $ref: '#/components/parameters/id' responses: '200': description: Security rule deleted successfully. content: application/json: schema: $ref: '#/components/schemas/DeleteResponse' examples: DeleteSecurityRule200Example: summary: Default deleteSecurityRule 200 response x-microcks-default: true value: id: example-id '401': $ref: '#/components/responses/Unauthorized_3' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK components: schemas: RuleDestination: type: object description: Traffic destination matching criteria for a security rule. properties: Cidrs: type: array items: type: string description: Destination CIDR blocks. example: - example-Cidrs_item - example-Cidrs_item Countries: type: array items: type: string description: Destination country codes. example: - example-Countries_item - example-Countries_item Feeds: type: array items: type: string example: - example-Feeds_item FqdnLists: type: array items: type: string description: Names of FQDN lists defined in the rule stack. example: - example-FqdnLists_item PrefixLists: type: array items: type: string example: - example-PrefixLists_item RuleSource: type: object description: Traffic source matching criteria for a security rule. properties: Cidrs: type: array items: type: string description: Source CIDR blocks (e.g., 10.0.0.0/8). example: - example-Cidrs_item - example-Cidrs_item Countries: type: array items: type: string description: Source country codes (ISO 3166-1 alpha-2). example: - example-Countries_item Feeds: type: array items: type: string description: Threat intelligence feed names. example: - example-Feeds_item - example-Feeds_item PrefixLists: type: array items: type: string description: Names of prefix lists defined in the rule stack. example: - example-PrefixLists_item - example-PrefixLists_item DeleteResponse: type: object properties: id: type: string description: Identifier of the deleted resource. example: example-id ErrorResponse: type: object properties: ResponseStatus: type: object properties: ErrorCode: type: integer example: 869 Reason: type: string example: Blocked investigation activity firewall activity malware network on applied. example: ErrorCode: 719 Reason: Alert incident applied violation rule blocked alert violation incident suspicious suspicious. ResponseStatus: type: object description: Standard API response status envelope included in all responses. properties: ErrorCode: type: integer description: Error code. 0 indicates success. example: 0 Reason: type: string description: Human-readable status message. example: '' SecurityRule_3: type: object description: A security policy rule defining traffic matching criteria and enforcement action applied by managed firewalls. properties: id: type: string format: uuid readOnly: true example: 6c72fa83-24c0-4558-897f-a344aa4b1076 name: type: string example: Branch Firewall 85 folder: type: string readOnly: true example: example-folder position: type: string enum: - pre - post example: post from: type: array items: type: string description: Source security zones. example: - example-from_item to: type: array items: type: string description: Destination security zones. example: - example-to_item - example-to_item source: type: array items: type: string description: Source addresses or address groups (use "any" for all). example: - example-source_item - example-source_item destination: type: array items: type: string description: Destination addresses or address groups. example: - example-destination_item - example-destination_item source_user: type: array items: type: string description: Source users or user groups. example: - example-source_user_item application: type: array items: type: string description: Applications to match (e.g., ssl, web-browsing). example: - ssl service: type: array items: type: string description: Service objects or application-default. example: - example-service_item - example-service_item category: type: array items: type: string description: URL categories to match. example: - advanced action: type: string enum: - allow - deny - drop - reset-client - reset-server - reset-both example: reset-both log_setting: type: string description: Log forwarding profile name. example: example-log_setting profile_setting: type: object properties: group: type: array items: type: string example: - example-group_item example: group: - example-group_item - example-group_item disabled: type: boolean default: false example: false description: type: string example: Alert activity firewall malware traffic incident Security configured rule. tag: type: array items: type: string example: - critical-asset SecurityRule_2: type: object required: - name - from - to - source - destination - application - action properties: id: type: string readOnly: true example: example-id name: type: string description: Name of the security rule. example: Branch Policy 74 description: type: string example: Security incident incident threat violation malware. disabled: type: boolean default: false example: false from: type: array description: Source security zones. items: type: string example: - example-from_item to: type: array description: Destination security zones. items: type: string example: - example-to_item source: type: array description: Source addresses or address groups. items: type: string example: - example-source_item - example-source_item destination: type: array description: Destination addresses or address groups. items: type: string example: - example-destination_item source_user: type: array description: Source user or user group names. items: type: string example: - example-source_user_item application: type: array description: Applications to match. items: type: string example: - ssl - dns service: type: array description: Services or service groups to match. items: type: string example: - example-service_item category: type: array description: URL categories to match. items: type: string example: - custom action: type: string enum: - allow - deny - drop - reset-client - reset-server - reset-both description: Action to take when the rule matches. example: drop profile_setting: type: object properties: group: type: array items: type: string description: Security profile group names. example: - example-group_item example: group: - example-group_item log_setting: type: string description: Log forwarding profile name. example: example-log_setting tag: type: array items: type: string example: - production - critical-asset folder: type: string readOnly: true example: example-folder position: type: string enum: - pre - post readOnly: true example: pre SecurityRuleList: type: object properties: data: type: array items: $ref: '#/components/schemas/SecurityRule_3' example: - id: 6c72fa83-24c0-4558-897f-a344aa4b1076 name: Branch Firewall 85 folder: example-folder position: post from: &id041 - example-from_item to: &id042 - example-to_item - example-to_item source: &id043 - example-source_item - example-source_item destination: &id044 - example-destination_item - example-destination_item source_user: &id045 - example-source_user_item application: &id046 - ssl service: &id047 - example-service_item - example-service_item category: &id048 - advanced action: reset-both log_setting: example-log_setting profile_setting: &id049 group: - example-group_item - example-group_item disabled: false description: Alert activity firewall malware traffic incident Security configured rule. tag: &id050 - critical-asset - id: 6c72fa83-24c0-4558-897f-a344aa4b1076 name: Branch Firewall 85 folder: example-folder position: post from: *id041 to: *id042 source: *id043 destination: *id044 source_user: *id045 application: *id046 service: *id047 category: *id048 action: reset-both log_setting: example-log_setting profile_setting: *id049 disabled: false description: Alert activity firewall malware traffic incident Security configured rule. tag: *id050 offset: type: integer example: 977 total: type: integer example: 964 limit: type: integer example: 574 SecurityRuleRequest_2: type: object required: - name - action properties: name: type: string example: Staging Policy 74 from: type: array items: type: string default: &id051 - any example: *id051 to: type: array items: type: string default: &id052 - any example: *id052 source: type: array items: type: string default: &id053 - any example: *id053 destination: type: array items: type: string default: &id054 - any example: *id054 source_user: type: array items: type: string example: - example-source_user_item application: type: array items: type: string default: &id055 - any example: *id055 service: type: array items: type: string default: &id056 - application-default example: *id056 category: type: array items: type: string example: - standard action: type: string enum: - allow - deny - drop - reset-client - reset-server - reset-both example: allow log_setting: type: string example: example-log_setting profile_setting: type: object properties: group: type: array items: type: string example: - example-group_item example: group: - example-group_item - example-group_item disabled: type: boolean default: false example: false description: type: string example: Threat applied on alert monitoring incident rule on monitoring. tag: type: array items: type: string example: - critical-asset - production SecurityRule: type: object description: A security rule within a Cloud NGFW rule stack. properties: Priority: type: integer description: Rule evaluation priority (lower numbers evaluated first). example: 707 RuleEntry: type: object properties: RuleName: type: string example: Staging Policy 40 Description: type: string example: Threat network configured alert configured violation rule malware alert monitoring threat. Enabled: type: boolean default: true example: true Source: $ref: '#/components/schemas/RuleSource' NegateSource: type: boolean default: false example: false Destination: $ref: '#/components/schemas/RuleDestination' NegateDestination: type: boolean default: false example: false Applications: type: array items: type: string description: Application names to match (use any for all applications). example: - ssl - ssh Category: type: object properties: URLCategoryNames: type: array items: type: string example: - Staging Firewall 58 - Primary Firewall 83 Feeds: type: array items: type: string example: - example-Feeds_item - example-Feeds_item example: URLCategoryNames: - Production Firewall 26 - Primary Policy 38 Feeds: - example-Feeds_item Protocol: type: string enum: - APPLICATION-DEFAULT - TCP - UDP - ICMP - ANY example: ICMP Action: type: string enum: - Allow - DenyResetBoth - DenyResetServer - DenySilent example: Allow DecryptionRuleType: type: string enum: - SSLOutboundInspection - None example: None AuditComment: type: string example: Blocked suspicious rule investigation activity on. example: RuleName: Primary Gateway 01 Description: Firewall alert incident monitoring investigation threat threat blocked activity monitoring. Enabled: true Source: Cidrs: - example-Cidrs_item - example-Cidrs_item Countries: - example-Countries_item - example-Countries_item Feeds: - example-Feeds_item PrefixLists: - example-PrefixLists_item NegateSource: false Destination: Cidrs: - example-Cidrs_item Countries: - example-Countries_item - example-Countries_item Feeds: - example-Feeds_item FqdnLists: - example-FqdnLists_item - example-FqdnLists_item PrefixLists: - example-PrefixLists_item NegateDestination: false Applications: - dns - web-browsing Category: URLCategoryNames: - Production Sensor 06 Feeds: - example-Feeds_item Protocol: UDP Action: Allow DecryptionRuleType: SSLOutboundInspection AuditComment: Rule malware monitoring malware firewall violation suspicious detected applied firewall detected applied. SecurityRuleSummary: type: object properties: Priority: type: integer example: 234 RuleName: type: string example: Production Policy 12 Enabled: type: boolean example: false ErrorResponse_3: type: object properties: _errors: type: array items: type: object properties: code: type: string example: example-code message: type: string example: Investigation incident suspicious network policy network endpoint endpoint policy investigation activity. details: type: object example: {} example: - code: example-code message: Security monitoring rule configured endpoint on network blocked. details: {} - code: example-code message: Security on on threat monitoring activity policy. details: {} _request_id: type: string description: Unique request identifier for troubleshooting. example: '574499' SecurityRuleRequest: type: object required: - Priority - RuleEntry properties: Priority: type: integer minimum: 1 maximum: 65535 example: 48316 RuleEntry: type: object required: - RuleName - Action properties: RuleName: type: string example: Primary Sensor 76 Description: type: string example: Threat alert rule policy investigation on activity rule threat activity traffic. Enabled: type: boolean default: true example: true Source: $ref: '#/components/schemas/RuleSource' Destination: $ref: '#/components/schemas/RuleDestination' Applications: type: array items: type: string example: - ssl - web-browsing Protocol: type: string enum: - APPLICATION-DEFAULT - ANY example: APPLICATION-DEFAULT Action: type: string enum: - Allow - DenyResetBoth - DenyResetServer - DenySilent example: DenyResetServer example: RuleName: Primary Gateway 01 Description: Activity Security blocked suspicious threat alert activity firewall. Enabled: true Source: Cidrs: - example-Cidrs_item Countries: - example-Countries_item Feeds: - example-Feeds_item - example-Feeds_item PrefixLists: - example-PrefixLists_item - example-PrefixLists_item Destination: Cidrs: - example-Cidrs_item - example-Cidrs_item Countries: - example-Countries_item - example-Countries_item Feeds: - example-Feeds_item FqdnLists: - example-FqdnLists_item - example-FqdnLists_item PrefixLists: - example-PrefixLists_item Applications: - ssh Protocol: APPLICATION-DEFAULT Action: DenySilent ErrorResponse_2: type: object properties: _errors: type: array items: type: object properties: code: type: string example: example-code message: type: string example: Alert malware configured threat rule network malware configured on. details: type: object example: {} example: - code: example-code message: Threat configured alert firewall violation monitoring traffic activity. details: {} - code: example-code message: Blocked threat Security traffic firewall monitoring malware endpoint suspicious network. details: {} _request_id: type: string example: '980164' parameters: snippet: name: snippet in: query description: Configuration snippet name. schema: type: string rulestack: name: rulestack in: path required: true description: Name of the rule stack. schema: type: string id: name: id in: path required: true description: Unique identifier of the resource. schema: type: string format: uuid offset: name: offset in: query description: Pagination offset (number of records to skip). schema: type: integer default: 0 priority: name: priority in: path required: true description: Priority number of the security rule. Rules with lower numbers are evaluated first (range 1-65535). schema: type: integer minimum: 1 maximum: 65535 folder: name: folder in: query description: Configuration folder scope (e.g., Shared, Mobile Users, Remote Networks, Service Connections). schema: type: string device: name: device in: query description: Device name for device-scoped configuration. schema: type: string position: name: position in: query description: Rulebase position filter. schema: type: string enum: - pre - post limit: name: limit in: query description: Maximum number of results per page. schema: type: integer default: 200 maximum: 5000 responses: BadRequest_2: description: Invalid request parameters or body. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_2' NotFound: description: The requested resource was not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden_2: description: Insufficient permissions for the requested operation. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_3' Unauthorized_3: description: Missing or invalid authentication token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_3' Conflict_2: description: A resource with the specified name already exists or the resource cannot be modified due to existing references. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_3' InternalServerError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_2' Unauthorized_2: description: Missing or invalid OAuth2 access token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_2' Forbidden: description: Insufficient permissions for this operation. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_2' Unauthorized: description: Missing or invalid AWS credentials. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Conflict: description: A resource with the specified name already exists or cannot be modified. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' BadRequest: description: Malformed request or invalid parameters. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: oauth2Bearer: type: http scheme: bearer bearerFormat: JWT description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.