Palo Alto Networks PAN-OS

Purpose

This integration uses the PAN-OS XML/REST API with a read-only administrator role to collect firewall policy, threat prevention, App-ID and firmware evidence, including Panorama-managed estates.

Requirements

• PAN-OS 10.x+ (firewall or Panorama) with API access enabled
• A read-only administrator role profile
• Network reachability from the collector to the management interface or Panorama

Permissions

• Custom admin role with Read-Only access to Policies, Objects, Network and Device tabs
• API key generated for that role, scoped via the standard PAN-OS API key generation endpoint

Setup

1. 1
   Create a read-only role profile

   Under Device > Admin Roles, create a role with Read-Only web UI and XML API access to Policies, Network and Device.
2. 2
   Create the API-only administrator

   Create an administrator bound to that role, dedicated to AssurIQ.
3. 3
   Generate the API key

   Generate the API key via the keygen API call and store it in the Credential Vault.
4. 4
   Add the firewall or Panorama to AssurIQ

   Add the management IP and API key under Integrations.
5. 5
   Verify collection

   Confirm security policy, App-ID and threat prevention evidence populate.

Verification

• Firewall or Panorama-managed devices appear in Network Map and Attack Surface
• Security policy and App-ID evidence populate in Evidence Vault
• PAN-OS version and content update status are current

Data collected

• Security and NAT policy rulebase (read-only)
• App-ID and threat prevention profile configuration
• PAN-OS and content/antivirus version status
• Interface and zone configuration, including internet-facing zones

Security model

The dedicated administrator role is restricted to read-only access on the relevant tabs; the API key cannot commit configuration changes. All calls run over HTTPS to the management interface or Panorama.

Common errors

• AIQ-CRD-001Credentials failing
  Stored credentials were rejected by one or more targets.

Troubleshooting

• If Panorama-managed firewalls do not appear individually, confirm the connector is pointed at Panorama, not an individual firewall, for multi-device estates.
• If content version looks stale, confirm scheduled dynamic updates are enabled on the device.

Disconnect

1. Remove the device or Panorama instance from AssurIQ Integrations.
2. Delete the dedicated API administrator and role from PAN-OS.