Skip to main content

Palo Alto Panorama

Visualize your Palo Alto Panorama estate in JupiterOne — the managed firewalls, device groups, address objects and address groups, and the security policy rules applied across them — and monitor policy and inventory changes through queries and alerts.

Installation​

This integration reads data from Palo Alto Panorama over the PAN-OS XML API — the Panorama instance itself, the firewalls it manages, device groups, address objects and address groups, and the pre- and post-rulebase security policy rules. It is read-only: it issues only configuration read and operational show requests, and never commits or modifies your configuration.

Panorama is typically deployed on-premises and not reachable from the internet, so this integration is most often run through a JupiterOne Collector inside your network.

Configuration in Panorama​

The integration authenticates as a Panorama administrator and generates an API key with a type=keygen request. Create a dedicated administrator for it rather than reusing an existing account.

1. Create an Admin Role profile with XML API access​

  1. Log in to the Panorama web interface as an administrator.

  2. Select Panorama > Admin Roles and click Add.

  3. Enter a Name for the profile — for example, jupiterone-readonly.

  4. Set the Role type to Panorama.

    info

    The XML API tab is only available when the Role type is Panorama. A Device Group and Template role cannot be granted XML API access.

  5. Select the XML API tab and Enable the following two functional areas, leaving the rest Disabled:

    XML API functional areaWhy the integration needs it
    ConfigurationReads device groups, address objects, address groups, and security rules (type=config).
    Operational RequestsRuns show system info, show devices all, and show dg-hierarchy (type=op).

    Report, Log, Commit, User-ID Agent, Export, and Import are not used and should stay disabled.

    note

    The XML API functional areas are single Enabled/Disabled toggles — unlike the Web UI tab, they have no read-only setting. Enabling Configuration therefore permits both retrieving and modifying configuration over the XML API. The integration only ever retrieves it.

  6. Click OK.

2. Create the administrator account​

  1. Select Panorama > Administrators and click Add.

  2. Enter a Name for the administrator — for example, jupiterone.

  3. Leave Authentication Profile set to None and enter a Password to authenticate locally, or select an authentication profile if you manage administrators externally.

  4. Set Administrator Type to Custom Panorama Admin and select the Admin Role profile you created above.

  5. Click OK.

3. Commit your changes​

Select Commit > Commit to Panorama to apply the new role and administrator.

Network and TLS requirements​

  • The integration reaches Panorama over HTTPS on port 443. Ensure the Collector has network access to the Panorama management interface, and that the management interface permits HTTPS access from it.

  • If Panorama presents a self-signed or internal-CA TLS certificate, obtain that CA certificate in PEM format so the Collector can verify the connection.

Once you have the hostname, username, and password, proceed to JupiterOne to finalize the integration.

Configuration in JupiterOne​

To install the Palo Alto Panorama integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Palo Alto Panorama. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Palo Alto Panorama account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Your Panorama Host — the hostname or IP address of your Panorama instance, without a scheme or path, for example panorama.example.com.

  • The Username and Password of the Panorama administrator you created.

  • Optionally, a CA Certificate in PEM format to trust a self-signed or internal-CA certificate, or enable Disable TLS Verification to skip certificate validation entirely (not recommended).

Click Create once all values are provided to finalize the integration.

Data sources​

You can narrow what the integration collects from the instance's ingestion source settings. Fetch Device Groups underpins the others — device groups are the scope that address objects, address groups, and security rules are read from, and disabling it leaves those steps with only the shared-scope objects.

Ingestion sourceData collected
Fetch FirewallsFirewalls managed by Panorama, with model, PAN-OS and content versions, and HA state.
Fetch Device GroupsDevice groups and the parent/child hierarchy between them.
Fetch Address ObjectsAddress objects in each device group and in the shared scope.
Fetch Address GroupsStatic and dynamic address groups, and their static members.
Fetch Security RulesPre- and post-rulebase security policy rules in each device group and the shared scope.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.

Additional resources​