PAN-OS by Palo Alto Networks

Details
Content
Dependencies
Version History

Manage Palo Alto Networks Firewall and Panorama. Use this pack to manage Prisma Access through Panorama. For more information see Panorama documentation.

PAN‑OS is the software that runs all Palo Alto Networks next-generation firewalls.
Using this pack, you can monitor and prevent phishing attacks by controlling the sites to which users can submit valid corporate credentials, and to enforce safe search for search engines like Google and Bing.

What does this pack do?

Create and manage custom security rules in Palo Alto Networks PAN-OS.
Create and manage address objects, address-groups, custom URL categories, URL filtering objects.
Use the URL Filtering category information to enrich URLs.
Commit configurations to Palo Alto Firewall and to Panorama, and push configurations from Panorama to Pre-Defined Device-Groups of Firewalls.
Upgrade the version and content of the firewall.
Query the following PAN-OS log types: traffic, threat, url, data-filtering, and Wildfire.
Manage External Dynamic Lists (EDLs).

As part of this pack, you will get several playbooks to facilitate your workflows.

Pack Contributors:

Adam Baumeister
Adam Burt
Johnathan Wilkes
Maciej Drobniuch

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

What does this pack do?

Create and manage custom security rules in Palo Alto Networks PAN-OS.
Create and manage address objects, address-groups, custom URL categories, URL filtering objects.
Use the URL Filtering category information to enrich URLs.
Commit configurations to Palo Alto Firewall and to Panorama, and push configurations from Panorama to Pre-Defined Device-Groups of Firewalls.
Upgrade the version and content of the firewall.
Query the following PAN-OS log types: traffic, threat, url, data-filtering, and Wildfire.
Manage External Dynamic Lists (EDLs).

As part of this pack, you will get several playbooks to facilitate your workflows.

Pack Contributors:

Adam Baumeister
Adam Burt
Johnathan Wilkes
Maciej Drobniuch

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Automations

Name	Description
PanoramaCVECoverage	Check coverage given a list of CVEs.
PanoramaSecurityPolicyMatchWrapper	A wrapper script for the panorama-security-policy-match command that receives multiple values for the source, destination, and destination port arguments and performs the policy match for each combination of the inputs.

Classifiers

Name	Description
Panorama Classifier	Classifies incoming PAN-OS Log incidents.
Panorama Mapper	Maps incoming PAN-OS Log incidents.

Incident Fields

Name	Description
Target Firewall Version	Version to install on the firewall e.g. 9.0.5 for PAN-OS
CVE List	List of CVEs to check
Target	Target Firewall - Usually serial number

Incident Types

Name	Description
PAN-OS Traffic Log Incident
PAN-OS Threat Log Incident
PAN-OS Decryption Log Incident
PanoramaThreatCoverage
PAN-OS Wildfire Submissions Log Incident
FirewallUpgrade
PAN-OS URL Log Incident
PAN-OS System Log Incident
PAN-OS Data Log Incident
PAN-OS Correlation Log Incident

Integrations

Name	Description
Palo Alto Networks PAN-OS	Manage Palo Alto Networks Firewall and Panorama. Use this pack to manage Prisma Access through Panorama. For more information, see the Panorama documentation.

Layouts

Name	Description
Panorama Threat Coverage Layout

Playbooks

Name	Description
NetOps - Upgrade PAN-OS Firewall Device	Network operations playbook that upgrades the firewall. You must have Superuser permissions to update the PAN-OS version. Note: This playbook should only be used for minor version upgrades. Major version upgrades will not work due to a change in the API key.
panorama_content_update_test	This playbook pulls Panorama content update file from shared SMB folder, uploads it to the Panorama server and installs it. It also uploads the content file to SCP folder for future use of the Panorama Device Deployment content updates engine which can be scheduled to pull the files automatically from SCP server. This playbook should run in "Air Gap internal network" and works together with "Air Gap - Panorama Content Update Sender - External" playbook that runs in "Air Gap external network". This playbook should be run as part of a Job in the internal network. Playbook inputs: panorama_admin_email - email address of the panorama admin for sending the output of the update. smbshare - the SMB share of the content update folder. Example: Folder scpwildfire - scp folder for wildfire content update file. Example: /home/demisto/Folder/wildfire scpcontents - scp folder for contents (antivirus and apps) content update file. Example: /home/demisto/Folder/contents scpantivirus - scp folder for Anti-Virus content update file. Example: /home/demisto/Folder/antivirus smbpath - SMB path to the content files files. Example: Content
PAN-OS Query Logs For Indicators	This playbook queries the following PAN-OS log types: traffic, threat, url, data-filtering and wildfire. The playbook accepts inputs such as IP. hash, and url.
PAN-OS Log Forwarding Setup And Configuration	This playbook sets up and maintains log forwarding for the Panorama rulebase. It can be run when setting up a new instance, or as a periodic job to enforce log forwarding policy. You can either update all rules and override previous profiles, or update only rules that do not have a log forwarding profile configured.
PAN-OS - Extract IPs From Traffic Logs To Sinkhole	This playbook searches for outgoing traffic to the sinkhole address in PAN-OS. It should be used after a DNS sinkhole was created using the "PAN-OS - Configure DNS Sinkhole" playbook. If a DNS sinkhole was created manually, you should verify in your PAN-OS firewall that there is an address object for the sinkhole FQDN "sinkhole.paloaltonetworks.com", and that there is a rule denying traffic to it from any source. You may specify the name of the deny rule if you know it, or you can let the playbook find the rule automatically.
PAN-OS - Block IP - Custom Block Rule	This playbook blocks IP addresses using Custom Block Rules in Palo Alto Networks Panorama or Firewall. The playbook receives malicious IP addresses as inputs, creates a custom bi-directional rule to block them, and commits the configuration.
PAN-OS - Job - Add Malicious Domains To Sinkhole	This TIM playbook should be run as a job. The playbook runs on domain indicators and performs various checks to decide if they should be sinkholed. If a domain is related to a campaign or a threat actor, or if it resolves to a malicious IP or has malware-related tags, the playbook will add a new tag to it in order to sinkhole that domain. The playbook assumes that the user is exporting indicators with the sinkhole tag to an EDL (External Dynamic List) using the Export Generic Indicators Service integration in Cortex XSOAR. That EDL should be connected to PAN-OS. It also assumes that a DNS sinkhole is configured in the PAN-OS firewall. However, these are not required for the sole purpose of tagging the domains. Note: This playbook has inputs from both the "From context data" tab and the "From indicators" tab.
Panorama Query Logs	Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.
PAN-OS Commit Configuration v2	Commit the PAN-OS Panorama or Firewall configuration. If specified as Panorama, it also pushes the Policies to the specified Device Group in the instance.
PAN-OS - Create Or Edit Rule	Creates or edits a Panorama rule and moves it into the desired position
NetOps - Firewall Version and Content Upgrade	Network operations playbook that updates the version and content of the firewall. You must have Superuser permissions to update the PAN-OS version.
PAN-OS DAG Configuration	This playbook utilizes the Dynamic Address Group (DAG) capability of PAN-OS. DAG enables analysts to create a rule one time, where the group is the source/destination, and adds IP addresses dynamically without the need to commit the configuration every time. The playbook checks if the given tag already exists. If the tag exists, then the IP address is added to the tag. If the tag does not exist, a new address group is created with the given tag and a matching rule, and the configuration is committed.
PAN-OS - Create Or Edit EDL Rule	Creates or edits a Panorama rule and moves it into the desired position
PAN-OS - Delete Static Routes	This playbook deletes a PAN-OS static route from the PAN-OS instance.
PAN-OS - Block URL - Custom URL Category	This playbook blocks URLs using Palo Alto Networks Panorama or Firewall through Custom URL Categories. The playbook checks whether the input URL category already exists, and if the URLs are a part of this category. Otherwise, it will create the category, block the URLs, and commit the configuration.
PAN-OS - Block IP - Static Address Group	This playbook blocks IP addresses using Static Address Groups in Palo Alto Networks Panorama or Firewall. The playbook receives malicious IP addresses and an address group name as inputs, verifies that the addresses are not already a part of the address group, adds them and commits the configuration. ***Note - The playbook does not block the address group communication using a policy block rule. This step will be taken once outside of the playbook.
PAN-OS - Block IPs From EDL - Custom Block Rule	This playbook blocks IP addresses from External Dynamic List using Custom Block Rules in Palo Alto Networks Panorama or Firewall. The playbook receives EDL name as input, creates a custom "from" directional rule to block, and commits the configuration.
PAN-OS - Add Domains EDL To Anti-Spyware	This playbook add domains EDL to Panorama Anti-Spyware. It assigns External Dynamic List URLs that contain domains to block to Panorama Anti-Spyware. You can create an External Dynamic List (EDL) and add domains to it using the Cortex XSOAR pack called "Generic Export Indicators Service". We recommend using this playbook as a one-time job. Once EDL is created and assigned to anti-spyware, domains can be blocked by adding them to the EDL.
PAN-OS - Add Anti-Spyware Security Profile To Rule	This playbook is designed to enhance the security level in PAN-OS firewalls by safely adding an Anti-Spyware security profile to a security rule. The playbook provides control over the behavior when a a rule: Already has an Anti-Spyware profile Uses a security profile group, with or without an Anti-Spyware profile The output of the playbook is the Anti-Spyware profile configured for the rule upon playbook completion. This can be: The initial profile, if untouched A newly overwritten profile A newly added profile
PAN-OS - Add Static Routes	This playbook accepts a PAN-OS static route configuration and creates it in the PAN-OS instance.
PAN-OS - Job - Remove Malicious Domains From Sinkhole	This playbook should be run as a job. It is used to periodically remove the specified tag from domain indicators. It should be used in conjunction with the "PAN-OS - Job - Add Malicious Domains To Sinkhole" playbook, to stop domains from being sinkholed after a certain amount of time. The idea is that traffic to malicious domains will not be redirected to a sinkhole address forever, as malicious domains tend to lose their malicious properties (become inactive, get taken down, or the malware using them is no longer used or maintained).
NetSec - Palo Alto Networks DUG - Tag User	Block a user by tagging them in the Palo Alto Networks NGFW. This requires PAN-OS 9.1 or higher.
PAN-OS - Block Destination Service	This playbook blocks a destination IP and service (TCP or UDP port) by creating a rule for a specific device group on PAN-OS.
NetOps Panorama coverage by CVE	Find if there is signature coverage for a specific CVE.
PAN-OS - Block IP	This playbook blocks IP addresses with 2 optional actions: Block IP addresses using Static Address Groups in Palo Alto Networks Panorama or Firewall. The playbook receives malicious IP addresses and an address group name as inputs, verifies that the addresses are not already a part of the address group, adds them and commits the configuration. Utilize the Dynamic Address Group (DAG) capability of PAN-OS. DAG enables analysts to create a rule one time, where the group is the source/destination, and adds IP addresses dynamically without the need to commit the configuration every time. The playbook checks if the given tag already exists. If the tag exists, then the IP address is added to the tag. If the tag does not exist, a new address group is created with the given tag and a matching rule, and the configuration is committed.
PAN-OS - Configure DNS Sinkhole	This playbook creates a DNS sinkhole in a PAN-OS firewall. It does the following: Finds a security rule that allows DNS traffic from the internal network to the internet using the "Security Policy Match" feature against traffic from the internal DNS server/s to the public DNS server. Creates or adds an existing anti-spyware security profile to the security rule/s that were found. Sets the DNS Signature Source under the DNS Policies configuration of the security profile with the "sinkhole" action. Creates an address object for the sinkhole address so that it can be referenced later in a deny rule (the sinkhole IP constantly rotates). Creates a new security rule to deny traffic to the sinkhole address object, in order to generate traffic logs for the compromised systems. The IPs of the compromised systems can then be retrieved using the "PAN-OS - Extract IPs From Traffic Logs To Sinkhole" playbook. Once the configuration is completed, the playbook will create a Tag object and tag the relevant security rules to indicate that sinkholing is configured. That tag will be checked in consecutive playbook runs in order to minimize the actions done on the firewall and time time spent in the playbook execution. How it works: A DNS sinkhole can be used to identify infected hosts on a network where there is an internal DNS Server in-route to the firewall that causes the reference of the original source IP address of the host that first originated the query to be lost (the query is received by the internal DNS server, and the internal DNS server sources a new query if the name-to-IP resolution is not locally cached). This causes the firewall to report observations of malicious DNS queries in the Threat logs where the source IP of the malicious DNS query is the Internal DNS server, which would force the administrator to look into the DNS Server logs to try to trace down what was the infected host that originally sourced the malicious DNS query. After a security profile with a "sinkhole" action for domains that are listed in the DNS signature source is applied to a rule that allows DNS traffic from the internal server/s to the external one, the threat logs will show that requests from the internal DNS server/s were sinkholed. However, the compromised systems will not appear in those logs. In order to find the IP addresses of those systems, a new rule denying all requests to our sinkhole address needs to be created. Since the infected systems received a forged DNS response (due to the security profile involved in our previous step), they will now try to connect to the sinkhole address, assuming it is their C&C server. The new rule will deny the subsequent attempts of those systems when they try to access the sinkhole address, and log them. Assumptions: The domains that should be sinkholed are already in a DNS signature source. It can be one of the following sources available in PAN-OS: An existing External Dynamic List (EDL) of type Domain configured in the PAN-OS firewall. Note: XSOAR simplifies the process of creating an EDL, with the Export Generic Indicators Service integration. Palo Alto Networks Content-delivered malicious domains DNS Security Categories available with a DNS Security subscription. There is at least one internal DNS server that is sending the DNS requests out through the firewall to a specific public DNS server.
PAN-OS Commit Configuration	Deprecated. Use PAN-OS Commit Configuration v2 instead.

Automations

Name	Description
PanoramaSecurityPolicyMatchWrapper	A wrapper script for the panorama-security-policy-match command that receives multiple values for the source, destination, and destination port arguments and performs the policy match for each combination of the inputs.
PanoramaCVECoverage	Check coverage given a list of CVEs.

Classifiers

Name	Description
Panorama Classifier	Classifies incoming PAN-OS Log incidents.
Panorama Mapper	Maps incoming PAN-OS Log incidents.

Incident Fields

Name	Description
CVE List	List of CVEs to check
Target	Target Firewall - Usually serial number
Target Firewall Version	Version to install on the firewall e.g. 9.0.5 for PAN-OS

Incident Types

Name	Description
PAN-OS Decryption Log Incident
FirewallUpgrade
PAN-OS Data Log Incident
PAN-OS System Log Incident
PAN-OS Wildfire Submissions Log Incident
PAN-OS Correlation Log Incident
PAN-OS URL Log Incident
PanoramaThreatCoverage
PAN-OS Traffic Log Incident
PAN-OS Threat Log Incident

Integrations

Name	Description
Palo Alto Networks PAN-OS	Manage Palo Alto Networks Firewall and Panorama. Use this pack to manage Prisma Access through Panorama. For more information, see the Panorama documentation.

Playbooks

Name	Description
PAN-OS - Add Anti-Spyware Security Profile To Rule	This playbook is designed to enhance the security level in PAN-OS firewalls by safely adding an Anti-Spyware security profile to a security rule. The playbook provides control over the behavior when a a rule: Already has an Anti-Spyware profile Uses a security profile group, with or without an Anti-Spyware profile The output of the playbook is the Anti-Spyware profile configured for the rule upon playbook completion. This can be: The initial profile, if untouched A newly overwritten profile A newly added profile
PAN-OS DAG Configuration	This playbook utilizes the Dynamic Address Group (DAG) capability of PAN-OS. DAG enables analysts to create a rule one time, where the group is the source/destination, and adds IP addresses dynamically without the need to commit the configuration every time. The playbook checks if the given tag already exists. If the tag exists, then the IP address is added to the tag. If the tag does not exist, a new address group is created with the given tag and a matching rule, and the configuration is committed.
PAN-OS - Configure DNS Sinkhole	This playbook creates a DNS sinkhole in a PAN-OS firewall. It does the following: Finds a security rule that allows DNS traffic from the internal network to the internet using the "Security Policy Match" feature against traffic from the internal DNS server/s to the public DNS server. Creates or adds an existing anti-spyware security profile to the security rule/s that were found. Sets the DNS Signature Source under the DNS Policies configuration of the security profile with the "sinkhole" action. Creates an address object for the sinkhole address so that it can be referenced later in a deny rule (the sinkhole IP constantly rotates). Creates a new security rule to deny traffic to the sinkhole address object, in order to generate traffic logs for the compromised systems. The IPs of the compromised systems can then be retrieved using the "PAN-OS - Extract IPs From Traffic Logs To Sinkhole" playbook. Once the configuration is completed, the playbook will create a Tag object and tag the relevant security rules to indicate that sinkholing is configured. That tag will be checked in consecutive playbook runs in order to minimize the actions done on the firewall and time time spent in the playbook execution. How it works: A DNS sinkhole can be used to identify infected hosts on a network where there is an internal DNS Server in-route to the firewall that causes the reference of the original source IP address of the host that first originated the query to be lost (the query is received by the internal DNS server, and the internal DNS server sources a new query if the name-to-IP resolution is not locally cached). This causes the firewall to report observations of malicious DNS queries in the Threat logs where the source IP of the malicious DNS query is the Internal DNS server, which would force the administrator to look into the DNS Server logs to try to trace down what was the infected host that originally sourced the malicious DNS query. After a security profile with a "sinkhole" action for domains that are listed in the DNS signature source is applied to a rule that allows DNS traffic from the internal server/s to the external one, the threat logs will show that requests from the internal DNS server/s were sinkholed. However, the compromised systems will not appear in those logs. In order to find the IP addresses of those systems, a new rule denying all requests to our sinkhole address needs to be created. Since the infected systems received a forged DNS response (due to the security profile involved in our previous step), they will now try to connect to the sinkhole address, assuming it is their C&C server. The new rule will deny the subsequent attempts of those systems when they try to access the sinkhole address, and log them. Assumptions: The domains that should be sinkholed are already in a DNS signature source. It can be one of the following sources available in PAN-OS: An existing External Dynamic List (EDL) of type Domain configured in the PAN-OS firewall. Note: XSOAR simplifies the process of creating an EDL, with the Export Generic Indicators Service integration. Palo Alto Networks Content-delivered malicious domains DNS Security Categories available with a DNS Security subscription. There is at least one internal DNS server that is sending the DNS requests out through the firewall to a specific public DNS server.
PAN-OS - Block IP	This playbook blocks IP addresses with 2 optional actions: Block IP addresses using Static Address Groups in Palo Alto Networks Panorama or Firewall. The playbook receives malicious IP addresses and an address group name as inputs, verifies that the addresses are not already a part of the address group, adds them and commits the configuration. Utilize the Dynamic Address Group (DAG) capability of PAN-OS. DAG enables analysts to create a rule one time, where the group is the source/destination, and adds IP addresses dynamically without the need to commit the configuration every time. The playbook checks if the given tag already exists. If the tag exists, then the IP address is added to the tag. If the tag does not exist, a new address group is created with the given tag and a matching rule, and the configuration is committed.
PAN-OS - Block IPs From EDL - Custom Block Rule	This playbook blocks IP addresses from External Dynamic List using Custom Block Rules in Palo Alto Networks Panorama or Firewall. The playbook receives EDL name as input, creates a custom "from" directional rule to block, and commits the configuration.
NetOps - Firewall Version and Content Upgrade	Network operations playbook that updates the version and content of the firewall. You must have Superuser permissions to update the PAN-OS version.
NetOps Panorama coverage by CVE	Find if there is signature coverage for a specific CVE.
panorama_content_update_test	This playbook pulls Panorama content update file from shared SMB folder, uploads it to the Panorama server and installs it. It also uploads the content file to SCP folder for future use of the Panorama Device Deployment content updates engine which can be scheduled to pull the files automatically from SCP server. This playbook should run in "Air Gap internal network" and works together with "Air Gap - Panorama Content Update Sender - External" playbook that runs in "Air Gap external network". This playbook should be run as part of a Job in the internal network. Playbook inputs: panorama_admin_email - email address of the panorama admin for sending the output of the update. smbshare - the SMB share of the content update folder. Example: Folder scpwildfire - scp folder for wildfire content update file. Example: /home/demisto/Folder/wildfire scpcontents - scp folder for contents (antivirus and apps) content update file. Example: /home/demisto/Folder/contents scpantivirus - scp folder for Anti-Virus content update file. Example: /home/demisto/Folder/antivirus smbpath - SMB path to the content files files. Example: Content
PAN-OS - Job - Remove Malicious Domains From Sinkhole	This playbook should be run as a job. It is used to periodically remove the specified tag from domain indicators. It should be used in conjunction with the "PAN-OS - Job - Add Malicious Domains To Sinkhole" playbook, to stop domains from being sinkholed after a certain amount of time. The idea is that traffic to malicious domains will not be redirected to a sinkhole address forever, as malicious domains tend to lose their malicious properties (become inactive, get taken down, or the malware using them is no longer used or maintained).
PAN-OS - Block URL - Custom URL Category	This playbook blocks URLs using Palo Alto Networks Panorama or Firewall through Custom URL Categories. The playbook checks whether the input URL category already exists, and if the URLs are a part of this category. Otherwise, it will create the category, block the URLs, and commit the configuration.
PAN-OS - Create Or Edit Rule	Creates or edits a Panorama rule and moves it into the desired position
NetOps - Upgrade PAN-OS Firewall Device	Network operations playbook that upgrades the firewall. You must have Superuser permissions to update the PAN-OS version. Note: This playbook should only be used for minor version upgrades. Major version upgrades will not work due to a change in the API key.
PAN-OS Query Logs For Indicators	This playbook queries the following PAN-OS log types: traffic, threat, url, data-filtering and wildfire. The playbook accepts inputs such as IP. hash, and url.
Panorama Query Logs	Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.
PAN-OS - Block IP - Static Address Group	This playbook blocks IP addresses using Static Address Groups in Palo Alto Networks Panorama or Firewall. The playbook receives malicious IP addresses and an address group name as inputs, verifies that the addresses are not already a part of the address group, adds them and commits the configuration. ***Note - The playbook does not block the address group communication using a policy block rule. This step will be taken once outside of the playbook.
NetSec - Palo Alto Networks DUG - Tag User	Block a user by tagging them in the Palo Alto Networks NGFW. This requires PAN-OS 9.1 or higher.
PAN-OS - Block Destination Service	This playbook blocks a destination IP and service (TCP or UDP port) by creating a rule for a specific device group on PAN-OS.
PAN-OS Commit Configuration	Deprecated. Use PAN-OS Commit Configuration v2 instead.
PAN-OS Commit Configuration v2	Commit the PAN-OS Panorama or Firewall configuration. If specified as Panorama, it also pushes the Policies to the specified Device Group in the instance.
PAN-OS - Extract IPs From Traffic Logs To Sinkhole	This playbook searches for outgoing traffic to the sinkhole address in PAN-OS. It should be used after a DNS sinkhole was created using the "PAN-OS - Configure DNS Sinkhole" playbook. If a DNS sinkhole was created manually, you should verify in your PAN-OS firewall that there is an address object for the sinkhole FQDN "sinkhole.paloaltonetworks.com", and that there is a rule denying traffic to it from any source. You may specify the name of the deny rule if you know it, or you can let the playbook find the rule automatically.
PAN-OS - Job - Add Malicious Domains To Sinkhole	This TIM playbook should be run as a job. The playbook runs on domain indicators and performs various checks to decide if they should be sinkholed. If a domain is related to a campaign or a threat actor, or if it resolves to a malicious IP or has malware-related tags, the playbook will add a new tag to it in order to sinkhole that domain. The playbook assumes that the user is exporting indicators with the sinkhole tag to an EDL (External Dynamic List) using the Export Generic Indicators Service integration in Cortex. That EDL should be connected to PAN-OS. It also assumes that a DNS sinkhole is configured in the PAN-OS firewall. However, these are not required for the sole purpose of tagging the domains. Note: This playbook has inputs from both the "From context data" tab and the "From indicators" tab.
PAN-OS Log Forwarding Setup And Configuration	This playbook sets up and maintains log forwarding for the Panorama rulebase. It can be run when setting up a new instance, or as a periodic job to enforce log forwarding policy. You can either update all rules and override previous profiles, or update only rules that do not have a log forwarding profile configured.
PAN-OS - Delete Static Routes	This playbook deletes a PAN-OS static route from the PAN-OS instance.
PAN-OS - Block IP - Custom Block Rule	This playbook blocks IP addresses using Custom Block Rules in Palo Alto Networks Panorama or Firewall. The playbook receives malicious IP addresses as inputs, creates a custom bi-directional rule to block them, and commits the configuration.
PAN-OS - Create Or Edit EDL Rule	Creates or edits a Panorama rule and moves it into the desired position
PAN-OS - Add Static Routes	This playbook accepts a PAN-OS static route configuration and creates it in the PAN-OS instance.
PAN-OS - Add Domains EDL To Anti-Spyware	This playbook add domains EDL to Panorama Anti-Spyware. It assigns External Dynamic List URLs that contain domains to block to Panorama Anti-Spyware. You can create an External Dynamic List (EDL) and add domains to it using the Cortex pack called "Generic Export Indicators Service". We recommend using this playbook as a one-time job. Once EDL is created and assigned to anti-spyware, domains can be blocked by adding them to the EDL.

Required Content Packs (4)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Common Types	By: Cortex XSOAR

All level dependencies (7)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Aggregated Scripts	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR

2.6.37 - 10241230 (June 17, 2026)

Integrations

Palo Alto Networks PAN-OS

Added support for the template and device-group arguments in the pan-os-commit command.

Related pull requests:
- 44646

Download

2.6.36 - 10224262 (June 16, 2026)

Integrations

Palo Alto Networks PAN-OS

Added support for the pre_post argument in the pan-os-get-rule-hitcounts command.

Related pull requests:
- 44608

Download

2.6.35 - 10184276 (June 15, 2026)

Integrations

Palo Alto Networks PAN-OS

Fixed an issue where pan-os-get-url-category failed to recognize URL categories due to a case-sensitivity mismatch.
Updated the Docker image to: demisto/pan-os-python:1.0.0.10133006.

Related pull requests:
- 44652

Download

2.6.34 - 9945293 (June 8, 2026)

Playbooks

PAN-OS Commit Configuration v2

Documentation and metadata improvements.

PAN-OS - Create Or Edit Rule

Documentation and metadata improvements.

PAN-OS Commit Configuration

Documentation and metadata improvements.

Related pull requests:
- 44388

Download

2.6.33 - 8801294 (May 6, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 44045

Download

2.6.32 - 8515806 (April 27, 2026)

Integrations

Palo Alto Networks PAN-OS

Documentation and metadata improvements.

Related pull requests:
- 43975

Download

2.6.31 - 8479105 (April 26, 2026)

Mappers

Panorama Mapper

Documentation and metadata improvements.

Related pull requests:
- 43869

Download

2.6.30 - 8429843 (April 23, 2026)

Classifiers

Panorama Classifier

Documentation and metadata improvements.

Related pull requests:
- 43956

Download

2.6.29 - 8382811 (April 20, 2026)

PAN-OS by Palo Alto Networks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43976

Download

2.6.28 - 8300783 (April 16, 2026)

Integrations

Palo Alto Networks PAN-OS

Updated the pan-os-get-rule-hitcounts command to support metadata enrichment for multi-vsys pushed rules.

Related pull requests:
- 43697

Download

2.6.27 - 7843807 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43568

Download

2.6.26 - 7645318 (March 12, 2026)

Integrations

Palo Alto Networks PAN-OS

Documentation and metadata improvements.

Related pull requests:
- 43474

Download

2.6.25 - 7259908 (February 22, 2026)

Integrations

Palo Alto Networks PAN-OS

Fix pan-os-get-rule-hitcounts command to support multiple VSYS.

Related pull requests:
- 43025

Download

2.6.24 - 7217627 (February 18, 2026)

Integrations

Palo Alto Networks PAN-OS

Fixed an issue where fetch incidents deduplication prioritized sequential number (seqno) field over timestamp, causing newer logs to be filtered out.
Updated the Docker image to: demisto/pan-os-python:1.0.0.6975992.

Related pull requests:
- 43025
- 42914

Download

2.6.23 - 6920594 (January 28, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 42439

Download

2.6.22 - 6580350 (January 6, 2026)

PAN-OS by Palo Alto Networks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 42564

Download

2.6.21 - 6267616 (December 14, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 42234

Download

2.6.20 - 6105231 (December 2, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41590

Download

2.6.19 - 5888286 (November 16, 2025)

Integrations

Palo Alto Networks PAN-OS

Added support for newname argument in the pan-os command.

Related pull requests:
- 41915

Download

2.6.18 - 5818832 (November 11, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41805

Download

2.6.17 - 5801457 (November 10, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41857

Download

2.6.16 - 5725291 (November 4, 2025)

Integrations

Palo Alto Networks PAN-OS

Fixes query issue to apply the time filter across the entire query.

Related pull requests:
- 41668

Download

2.6.15 - 5717993 (November 3, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41760

Download

2.6.14 - 5698874 (November 2, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41748

Download

2.6.13 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

2.6.12 - 5538136 (October 23, 2025)

PAN-OS by Palo Alto Networks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41627

Download

2.6.11 - R5469292 (October 20, 2025)

Integrations

Palo Alto Networks PAN-OS

Fixed an issue where the pan-os-check-dynamic-updates-status command was failing when there was no WildFire license on the Firewall.

Related pull requests:
- 41476

Download

2.6.10 - 5208238 (September 30, 2025)

Documentation and metadata improvements.

Related pull requests:
- 41444

Download

2.6.9 - 4995327 (September 21, 2025)

Integrations

Palo Alto Networks PAN-OS

Fixed an issue where the pan-os-check-dynamic-updates-status command was failing when there was no Global Protect license on the Firewall.
Fixed an issue where the pan-os-check-dynamic-updates-status command was failing when there was no App/Threat or GP or Antivirus or Wildfire installed on the Firewall.
Added a validation for the pan-os-check-dynamic-updates-status command that verifies that the target argument is specified when running from a Panorama instance.
Updated the Docker image to: demisto/pan-os-python:1.0.0.4889421.

Related pull requests:
- 41314

Download

2.6.8 - 4739218 (September 2, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41078

Download

2.6.7 - 4712962 (August 31, 2025)

Scripts

Updated the documentation and metadata.

Related pull requests:
- 41083

Download

2.6.6 - 4633304 (August 24, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 40942

Download

2.6.5 - 4595408 (August 20, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 40919

Download

2.6.4 - 4486728 (August 11, 2025)

Documentation and metadata improvements.

Related pull requests:
- 40883

Download

2.6.3 - 4407872 (August 3, 2025)

Playbooks

PAN-OS - Block IP - Static Address Group

Documentation and metadata improvements.

PAN-OS - Create Or Edit Rule

Documentation and metadata improvements.

PAN-OS DAG Configuration

Documentation and metadata improvements.

PAN-OS Commit Configuration v2

Documentation and metadata improvements.

PAN-OS - Block URL - Custom URL Category

Documentation and metadata improvements.

Related pull requests:
- 40574

Download

2.6.2 - 4350237 (July 29, 2025)

Integrations

Palo Alto Networks PAN-OS

Fixed an issue where the tag command argument was not being used in the list-service-groups commands.

Related pull requests:
- 40734

Download

2.6.1 - 4324039 (July 27, 2025)

Integrations

Palo Alto Networks PAN-OS

Updated the Context Data keys of the *pan-os-delete-rule command.

Related pull requests:
- 40721

Download

2.6.0 - 4275053 (July 23, 2025)

Integrations

Palo Alto Networks PAN-OS

New Commands
The following commands have been added to provide abilities to identify multiple types of dynamic content with available updates on Palo Alto Networks PAN-OS firewalls and then download/install them. These commands support built-in polling.

Added command pan-os-get-rule-hitcounts, which returns hit counts for policy rules on firewalls. When connected to a Panorama instance this command retrieves hit count data from all connected firewalls.
Added command pan-os-disable-rule, which can be used to set a policy rule as disabled.
Enhancements to Existing Commands
Added support to pan-os-delete-rule to delete additional types of policy rules as well as delete rules from firewalls connected to Panorama. In addition to security policy rules, this command can now also delete the following types:
- application-override
- authentication
- decryption
- nat
- pbf
Enhanced the pan-os-platform-get-ha-state command to be capable of retrieving information about connected HA peers when the Integration instance is connected directly to a firewall. Previously this command only returned the peer's serial number in context output if it was connected to a Panorama system.

Playbooks

New: PAN-OS - Download and Install Dynamic Content Updates

This playbook automates the download and installation of the following Dynamic Update types on Palo Alto firewalls:

App/Threat
Anti-Virus
WildFire
GlobalProtect Clientless VPN
Use the "itemsToUpdate" input to control which update type(s) to download and install. All types are updated by default.
NOTE: This playbook is intended for use with a single PAN-OS Integration Instance.

New: PAN-OS - Firewall Upgrade Readiness Checks

This playbook uses the PAN-OS integration to check NGFW device conditions that can affect its readiness to perform a PAN-OS upgrade. Included checks examine the following:

Available disk space for the target version (base image + release image)
Presence of any uncommitted configuration changes
Whether device has an active Support license
Whether NTP is configured and synced
Whether the latest App/Threat dynamic update is installed
For devices in HA groups, check that devices in the group have:
1. App/Threat, AntiVirus, and GlobalProtect Client are at the same level and compatible for HA failover
2. Running configuration synchronized among peers
  Playbook output includes a register of the checks performed, a brief description, and their result.
  NOTE: This playbook is intended for use with a single PAN-OS Integration Instance.

New: PAN-OS - Identify Unused Policy Rules

The playbook collects and analyzes Palo Alto Networks NGFW policy rule hitcount information and generates a summary of unused rules for potential clean-up. Policy rules are classified into three categories:

Unused Local Rules - Rules configured locally on firewalls
Unused Panorama Rules - Rules pushed to one or more firewalls from Panorama that have zero hits on all firewalls.
Used Panorama Rules - Rules pushed to one or more firewalls from Panorama that have hits on some firewalls but not all.
i. These rules may be pushed to firewalls where they are not needed and should be considered for clean-up.
For firewalls in HA pairs, rules are only considered unused if all members of the HA group have zero hits for it.

New: PAN-OS - Run Security Configuration Hygiene Checks

This playbook executes hygiene check commands using the PAN-OS integration and identifies items configured in a manner that do not meet minimum security best practices. It looks for the following:

Log Forwarding Profiles
i. Profiles without Enhanced Logging enabled
ii. Profiles with no match list (rules) configured
iii. Profiles that do not include rules to forward Traffic or Threat logs
Security Zones with no Log Forwarding Profile assigned
Spyware Profiles that do not:
i. Block signatures of Critical and High severity
ii. Alert on (or block) signatures of Medium and Low severity
URL Filtering Profiles do not block the default URL categories blocked in the pre-defined profile
Vulnerability Profiles that do not:
i. Block signatures of Critical and High severity
ii. Alert on (or block) signatures of Medium and Low severity
Security Rules that do not:
i. Log at Session End
ii. Have a Log Forwarding Profile assigned
iii. Have Security Profiles assigned for Anti Virus, Spyware, Vulnerability, and URL Filtering (or a group that includes each)
NOTE: This playbook is intended for use with a single PAN-OS Integration Instance.

Scripts

New: PAN-OS-AnalyzeRuleHitCounts

New: Added a new script, PAN-OS-AnalyzeRuleHitCounts, that processes the context output from !pan-os-get-rulehitcounts and returns data about unused local rules, unused rules from Panorama, and rules from Panorama that have hits on some firewalls but not all.

New: PAN-OS-GetAvailablePANOSSoftware

New: Added a new script, PAN-OS-GetAvailablePANOSSoftware, that is a wrapper for the 'pano-os-platform-get-available-software' command, adding options to return only images newer than is currently installed to minimize the amount of context data generated.

New: PAN-OS-GetDeviceDiskSpace

New: Added a new script, PAN-OS-GetDeviceDiskSpace, that fetches disk space info from the target device and returns all information or a subset as specified in command arguments.

Related pull requests:
- 40493

Download

2.5.7 - 4261213 (July 22, 2025)

Playbooks

New: PAN-OS - Security Advisories Vulnerability Check

This playbook takes a CVE ID as published on the Palo Alto Networks Security Advisories page as input and checks if any Palo Alto Networks firewalls in your environment have PAN-OS software versions or GlobalProtect client package versions that are vulnerable to the specified CVE. It accepts an optional target parameter to check a specific firewall by serial number. If a non-Palo Alto Networks CVE is provided, the playbook will return an empty json output.

Scripts

New: CheckFirewallAndGPForCVEs

New: Added a new script, CheckFirewallAndGPForCVEs, that checks if PAN-OS firewall and GlobalProtect versions are affected by specific CVEs.

New: PAN-OS_Security_Advisories_Enrichment

New: Added a new script, PAN-OS_Security_Advisories_Enrichment, that enriches CVEs published by Palo Alto Networks with detailed vulnerability information from the official Palo Alto Networks Security Advisories page.

Related pull requests:
- 40414

Download

2.5.6 - 4206602 (July 17, 2025)

PAN-OS by Palo Alto Networks

Documentation and metadata improvements.

Related pull requests:
- 40625

Download

2.5.5 - 4180042 (July 15, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 40583

Download

2.5.4 - 4126849 (July 10, 2025)

PAN-OS by Palo Alto Networks

Documentation and metadata improvements.

Related pull requests:
- 39712
- 40179

Download

2.5.3 - 4121830 (July 10, 2025)

Classifiers

Panorama Classifier

Documentation and metadata improvements.

Incident Fields

Target Firewall Version
Documentation and metadata improvements.
CVE List
Documentation and metadata improvements.
Target
Documentation and metadata improvements.

Incident Types

FirewallUpgrade
Documentation and metadata improvements.
PAN-OS Correlation Log Incident
Documentation and metadata improvements.
PanoramaThreatCoverage
Documentation and metadata improvements.
PAN-OS System Log Incident
Documentation and metadata improvements.
PAN-OS Threat Log Incident
Documentation and metadata improvements.
PAN-OS Decryption Log Incident
Documentation and metadata improvements.
PAN-OS Data Log Incident
Documentation and metadata improvements.
PAN-OS URL Log Incident
Documentation and metadata improvements.
PAN-OS Traffic Log Incident
Documentation and metadata improvements.
PAN-OS Wildfire Submissions Log Incident
Documentation and metadata improvements.

Mappers

Panorama Mapper

Documentation and metadata improvements.

Playbooks

panorama_content_update_test

Documentation and metadata improvements.

PAN-OS - Block IP - Static Address Group

Documentation and metadata improvements.

PAN-OS - Block IP

Documentation and metadata improvements.

PAN-OS - Block URL - Custom URL Category

Documentation and metadata improvements.

NetSec - Palo Alto Networks DUG - Tag User

Documentation and metadata improvements.

PAN-OS - Block IPs From EDL - Custom Block Rule

Documentation and metadata improvements.

PAN-OS DAG Configuration

Documentation and metadata improvements.

PAN-OS - Add Anti-Spyware Security Profile To Rule

Documentation and metadata improvements.

NetOps - Upgrade PAN-OS Firewall Device

Documentation and metadata improvements.

Panorama Query Logs

Documentation and metadata improvements.

NetOps Panorama coverage by CVE

Documentation and metadata improvements.

PAN-OS - Configure DNS Sinkhole

Documentation and metadata improvements.

PAN-OS - Block IP - Custom Block Rule

Documentation and metadata improvements.

PAN-OS Query Logs For Indicators

Documentation and metadata improvements.

PAN-OS - Block Destination Service

Documentation and metadata improvements.

PAN-OS - Job - Remove Malicious Domains From Sinkhole

Documentation and metadata improvements.

PAN-OS - Job - Add Malicious Domains To Sinkhole

Documentation and metadata improvements.

PAN-OS - Create Or Edit EDL Rule

Documentation and metadata improvements.

PAN-OS Commit Configuration v2

Documentation and metadata improvements.

PAN-OS Log Forwarding Setup And Configuration

Documentation and metadata improvements.

PAN-OS - Add Static Routes

Documentation and metadata improvements.

PAN-OS - Add Domains EDL To Anti-Spyware

Documentation and metadata improvements.

NetOps - Firewall Version and Content Upgrade

Documentation and metadata improvements.

PAN-OS - Extract IPs From Traffic Logs To Sinkhole

Documentation and metadata improvements.

PAN-OS - Delete Static Routes

Documentation and metadata improvements.

PAN-OS Commit Configuration

Documentation and metadata improvements.

PAN-OS - Create Or Edit Rule

Documentation and metadata improvements.

Scripts

PanoramaCVECoverage

Documentation and metadata improvements.

PanoramaSecurityPolicyMatchWrapper

Documentation and metadata improvements.

Related pull requests:
- 40523

Download

2.5.2 - 4049458 (July 3, 2025)

Integrations

Palo Alto Networks PAN-OS

Added support for pan-os-check-dynamic-updates-status command that checks for the latest available dynamic update versions and returns a list of latest available / currently installed content.
Added support for pan-os-download-latest-antivirus-update command that downloads the latest AntiVirus dynamic update.
Added support for pan-os-download-latest-gp-update command that downloads the latest GlobalProtect Clientless VPN dynamic update.
Added support for pan-os-download-latest-wildfire-update command that downloads the latest WildFire dynamic update.
Added support for pan-os-install-latest-antivirus-update command that installs the latest AntiVirus update.
Added support for pan-os-install-latest-gp-update command that installs the latest GlobalProtect Clientless VPN dynamic update.
Added support for pan-os-install-latest-wildfire-update command that installs the latest WildFire dynamic update.

Enhancements to Existing Commands

Added support for built-in polling in the pan-os-download-latest-content-update command for downloading App/Threat updates. When polling argument is set to true it will return the final results of the download operation and no longer needs to be checked with the pan-os-content-update-download-status command.
Added support for built-in polling in the pan-os-install-latest-content-update command for installing App/Threat updates. When polling argument is set to true it will return the final results of the install operation and no longer needs to be checked with the pan-os-content-update-install-status command.

Related pull requests:
- 40292

Download

2.5.1 - 4017734 (June 30, 2025)

Integrations

Palo Alto Networks PAN-OS

Added a new command to get the certificate information from Panorama or Firewall, as seen under Certificate Management:
- pan-os-get-certificate-info

Related pull requests:
- 40308

Download

2.4.2 - R3980324 (June 26, 2025)

Integrations

Palo Alto Networks PAN-OS

Documentation and metadata improvements.

Related pull requests:
- 40270

Download

2.4.1 - 3849419 (June 18, 2025)

Scripts

PanoramaCVECoverage

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 40221

Download

2.6.37 - 10241230 (June 17, 2026)

Integrations

Palo Alto Networks PAN-OS

Added support for the template and device-group arguments in the pan-os-commit command.

Related pull requests:
- 44646

Download

2.6.36 - 10224262 (June 16, 2026)

Integrations

Palo Alto Networks PAN-OS

Added support for the pre_post argument in the pan-os-get-rule-hitcounts command.

Related pull requests:
- 44608

Download

2.6.35 - 10184276 (June 15, 2026)

Integrations

Palo Alto Networks PAN-OS

Fixed an issue where pan-os-get-url-category failed to recognize URL categories due to a case-sensitivity mismatch.
Updated the Docker image to: demisto/pan-os-python:1.0.0.10133006.

Related pull requests:
- 44652

Download

2.6.34 - 9945293 (June 8, 2026)

Playbooks

PAN-OS Commit Configuration v2

Documentation and metadata improvements.

PAN-OS - Create Or Edit Rule

Documentation and metadata improvements.

PAN-OS Commit Configuration

Documentation and metadata improvements.

Related pull requests:
- 44388

Download

2.6.33 - 8801294 (May 6, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 44045

Download

2.6.32 - 8542515 (April 28, 2026)

Integrations

Palo Alto Networks PAN-OS

Documentation and metadata improvements.

Related pull requests:
- 43975

Download

2.6.31 - 8479105 (April 26, 2026)

Mappers

Panorama Mapper

Documentation and metadata improvements.

Related pull requests:
- 43869

Download

2.6.30 - 8429843 (April 23, 2026)

Classifiers

Panorama Classifier

Documentation and metadata improvements.

Related pull requests:
- 43956

Download

2.6.29 - 8382811 (April 20, 2026)

PAN-OS by Palo Alto Networks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43976

Download

2.6.28 - 8300783 (April 16, 2026)

Integrations

Palo Alto Networks PAN-OS

Updated the pan-os-get-rule-hitcounts command to support metadata enrichment for multi-vsys pushed rules.

Related pull requests:
- 43697

Download

2.6.27 - 7850318 (March 23, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43568

Download

2.6.26 - 7645318 (March 12, 2026)

Integrations

Palo Alto Networks PAN-OS

Documentation and metadata improvements.

Related pull requests:
- 43474

Download

2.6.25 - 7259908 (February 22, 2026)

Integrations

Palo Alto Networks PAN-OS

Fix pan-os-get-rule-hitcounts command to support multiple VSYS.

Related pull requests:
- 43025

Download

2.6.24 - 7217627 (February 18, 2026)

Integrations

Palo Alto Networks PAN-OS

Fixed an issue where fetch incidents deduplication prioritized sequential number (seqno) field over timestamp, causing newer logs to be filtered out.
Updated the Docker image to: demisto/pan-os-python:1.0.0.6975992.

Related pull requests:
- 43025
- 42914

Download

2.6.23 - 6920581 (January 28, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 42439

Download

2.6.22 - 6580350 (January 6, 2026)

PAN-OS by Palo Alto Networks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 42564

Download

2.6.21 - 6267616 (December 14, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 42234

Download

2.6.20 - 6095247 (December 2, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41590

Download

2.6.19 - 5888286 (November 16, 2025)

Integrations

Palo Alto Networks PAN-OS

Added support for newname argument in the pan-os command.

Related pull requests:
- 41915

Download

2.6.18 - 5818832 (November 11, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41805

Download

2.6.17 - 5801457 (November 10, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41857

Download

2.6.16 - 5725291 (November 4, 2025)

Integrations

Palo Alto Networks PAN-OS

Fixes query issue to apply the time filter across the entire query.

Related pull requests:
- 41668

Download

2.6.15 - 5717993 (November 3, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41760

Download

2.6.14 - 5698874 (November 2, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41748

Download

2.6.13 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

2.6.12 - 5538136 (October 23, 2025)

PAN-OS by Palo Alto Networks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41627

Download

2.6.11 - R5456168 (October 19, 2025)

Integrations

Palo Alto Networks PAN-OS

Fixed an issue where the pan-os-check-dynamic-updates-status command was failing when there was no WildFire license on the Firewall.

Related pull requests:
- 41476

Download

2.6.10 - 5212533 (October 1, 2025)

Documentation and metadata improvements.

Related pull requests:
- 41444

Download

2.6.9 - 4995327 (September 21, 2025)

Integrations

Palo Alto Networks PAN-OS

Fixed an issue where the pan-os-check-dynamic-updates-status command was failing when there was no Global Protect license on the Firewall.
Fixed an issue where the pan-os-check-dynamic-updates-status command was failing when there was no App/Threat or GP or Antivirus or Wildfire installed on the Firewall.
Added a validation for the pan-os-check-dynamic-updates-status command that verifies that the target argument is specified when running from a Panorama instance.
Updated the Docker image to: demisto/pan-os-python:1.0.0.4889421.

Related pull requests:
- 41314

Download

2.6.8 - 4739218 (September 2, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41078

Download

2.6.7 - 4712962 (August 31, 2025)

Scripts

Updated the documentation and metadata.

Related pull requests:
- 41083

Download

2.6.6 - 4633304 (August 24, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 40942

Download

2.6.5 - 4595408 (August 20, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 40919

Download

2.6.4 - 4486728 (August 11, 2025)

Documentation and metadata improvements.

Related pull requests:
- 40883

Download

2.6.3 - 4407872 (August 3, 2025)

Playbooks

PAN-OS - Block IP - Static Address Group

Documentation and metadata improvements.

PAN-OS - Create Or Edit Rule

Documentation and metadata improvements.

PAN-OS DAG Configuration

Documentation and metadata improvements.

PAN-OS Commit Configuration v2

Documentation and metadata improvements.

PAN-OS - Block URL - Custom URL Category

Documentation and metadata improvements.

Related pull requests:
- 40574

Download

2.6.2 - 4350237 (July 29, 2025)

Integrations

Palo Alto Networks PAN-OS

Fixed an issue where the tag command argument was not being used in the list-service-groups commands.

Related pull requests:
- 40734

Download

2.6.1 - 4324039 (July 27, 2025)

Integrations

Palo Alto Networks PAN-OS

Updated the Context Data keys of the *pan-os-delete-rule command.

Related pull requests:
- 40721

Download

2.6.0 - 4275053 (July 23, 2025)

Integrations

Palo Alto Networks PAN-OS

Added command pan-os-get-rule-hitcounts, which returns hit counts for policy rules on firewalls. When connected to a Panorama instance this command retrieves hit count data from all connected firewalls.
Added command pan-os-disable-rule, which can be used to set a policy rule as disabled.
Enhancements to Existing Commands
Added support to pan-os-delete-rule to delete additional types of policy rules as well as delete rules from firewalls connected to Panorama. In addition to security policy rules, this command can now also delete the following types:
- application-override
- authentication
- decryption
- nat
- pbf
Enhanced the pan-os-platform-get-ha-state command to be capable of retrieving information about connected HA peers when the Integration instance is connected directly to a firewall. Previously this command only returned the peer's serial number in context output if it was connected to a Panorama system.

Playbooks

New: PAN-OS - Download and Install Dynamic Content Updates

This playbook automates the download and installation of the following Dynamic Update types on Palo Alto firewalls:

App/Threat
Anti-Virus
WildFire
GlobalProtect Clientless VPN
Use the "itemsToUpdate" input to control which update type(s) to download and install. All types are updated by default.
NOTE: This playbook is intended for use with a single PAN-OS Integration Instance.

New: PAN-OS - Firewall Upgrade Readiness Checks

This playbook uses the PAN-OS integration to check NGFW device conditions that can affect its readiness to perform a PAN-OS upgrade. Included checks examine the following:

Available disk space for the target version (base image + release image)
Presence of any uncommitted configuration changes
Whether device has an active Support license
Whether NTP is configured and synced
Whether the latest App/Threat dynamic update is installed
For devices in HA groups, check that devices in the group have:
1. App/Threat, AntiVirus, and GlobalProtect Client are at the same level and compatible for HA failover
2. Running configuration synchronized among peers
  Playbook output includes a register of the checks performed, a brief description, and their result.
  NOTE: This playbook is intended for use with a single PAN-OS Integration Instance.

New: PAN-OS - Identify Unused Policy Rules

Unused Local Rules - Rules configured locally on firewalls
Unused Panorama Rules - Rules pushed to one or more firewalls from Panorama that have zero hits on all firewalls.
Used Panorama Rules - Rules pushed to one or more firewalls from Panorama that have hits on some firewalls but not all.
i. These rules may be pushed to firewalls where they are not needed and should be considered for clean-up.
For firewalls in HA pairs, rules are only considered unused if all members of the HA group have zero hits for it.

New: PAN-OS - Run Security Configuration Hygiene Checks

This playbook executes hygiene check commands using the PAN-OS integration and identifies items configured in a manner that do not meet minimum security best practices. It looks for the following:

Log Forwarding Profiles
i. Profiles without Enhanced Logging enabled
ii. Profiles with no match list (rules) configured
iii. Profiles that do not include rules to forward Traffic or Threat logs
Security Zones with no Log Forwarding Profile assigned
Spyware Profiles that do not:
i. Block signatures of Critical and High severity
ii. Alert on (or block) signatures of Medium and Low severity
URL Filtering Profiles do not block the default URL categories blocked in the pre-defined profile
Vulnerability Profiles that do not:
i. Block signatures of Critical and High severity
ii. Alert on (or block) signatures of Medium and Low severity
Security Rules that do not:
i. Log at Session End
ii. Have a Log Forwarding Profile assigned
iii. Have Security Profiles assigned for Anti Virus, Spyware, Vulnerability, and URL Filtering (or a group that includes each)
NOTE: This playbook is intended for use with a single PAN-OS Integration Instance.

Scripts

New: PAN-OS-AnalyzeRuleHitCounts

New: Added a new script, PAN-OS-AnalyzeRuleHitCounts, that processes the context output from !pan-os-get-rulehitcounts and returns data about unused local rules, unused rules from Panorama, and rules from Panorama that have hits on some firewalls but not all.

New: PAN-OS-GetAvailablePANOSSoftware

New: Added a new script, PAN-OS-GetAvailablePANOSSoftware, that is a wrapper for the 'pano-os-platform-get-available-software' command, adding options to return only images newer than is currently installed to minimize the amount of context data generated.

New: PAN-OS-GetDeviceDiskSpace

New: Added a new script, PAN-OS-GetDeviceDiskSpace, that fetches disk space info from the target device and returns all information or a subset as specified in command arguments.

Related pull requests:
- 40493

Download

2.5.7 - 4261213 (July 22, 2025)

Playbooks

New: PAN-OS - Security Advisories Vulnerability Check

Scripts

New: CheckFirewallAndGPForCVEs

New: Added a new script, CheckFirewallAndGPForCVEs, that checks if PAN-OS firewall and GlobalProtect versions are affected by specific CVEs.

New: PAN-OS_Security_Advisories_Enrichment

New: Added a new script, PAN-OS_Security_Advisories_Enrichment, that enriches CVEs published by Palo Alto Networks with detailed vulnerability information from the official Palo Alto Networks Security Advisories page.

Related pull requests:
- 40414

Download

2.5.6 - 4206602 (July 17, 2025)

PAN-OS by Palo Alto Networks

Documentation and metadata improvements.

Related pull requests:
- 40625

Download

2.5.5 - 4180042 (July 15, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 40583

Download

2.5.4 - 4126849 (July 10, 2025)

PAN-OS by Palo Alto Networks

Documentation and metadata improvements.

Related pull requests:
- 39712
- 40179

Download

2.5.3 - 4118212 (July 9, 2025)

Classifiers

Panorama Classifier

Documentation and metadata improvements.

Incident Fields

Target Firewall Version
Documentation and metadata improvements.
CVE List
Documentation and metadata improvements.
Target
Documentation and metadata improvements.

Incident Types

FirewallUpgrade
Documentation and metadata improvements.
PAN-OS Correlation Log Incident
Documentation and metadata improvements.
PanoramaThreatCoverage
Documentation and metadata improvements.
PAN-OS System Log Incident
Documentation and metadata improvements.
PAN-OS Threat Log Incident
Documentation and metadata improvements.
PAN-OS Decryption Log Incident
Documentation and metadata improvements.
PAN-OS Data Log Incident
Documentation and metadata improvements.
PAN-OS URL Log Incident
Documentation and metadata improvements.
PAN-OS Traffic Log Incident
Documentation and metadata improvements.
PAN-OS Wildfire Submissions Log Incident
Documentation and metadata improvements.

Mappers

Panorama Mapper

Documentation and metadata improvements.

Playbooks

panorama_content_update_test

Documentation and metadata improvements.

PAN-OS - Block IP - Static Address Group

Documentation and metadata improvements.

PAN-OS - Block IP

Documentation and metadata improvements.

PAN-OS - Block URL - Custom URL Category

Documentation and metadata improvements.

NetSec - Palo Alto Networks DUG - Tag User

Documentation and metadata improvements.

PAN-OS - Block IPs From EDL - Custom Block Rule

Documentation and metadata improvements.

PAN-OS DAG Configuration

Documentation and metadata improvements.

PAN-OS - Add Anti-Spyware Security Profile To Rule

Documentation and metadata improvements.

NetOps - Upgrade PAN-OS Firewall Device

Documentation and metadata improvements.

Panorama Query Logs

Documentation and metadata improvements.

NetOps Panorama coverage by CVE

Documentation and metadata improvements.

PAN-OS - Configure DNS Sinkhole

Documentation and metadata improvements.

PAN-OS - Block IP - Custom Block Rule

Documentation and metadata improvements.

PAN-OS Query Logs For Indicators

Documentation and metadata improvements.

PAN-OS - Block Destination Service

Documentation and metadata improvements.

PAN-OS - Job - Remove Malicious Domains From Sinkhole

Documentation and metadata improvements.

PAN-OS - Job - Add Malicious Domains To Sinkhole

Documentation and metadata improvements.

PAN-OS - Create Or Edit EDL Rule

Documentation and metadata improvements.

PAN-OS Commit Configuration v2

Documentation and metadata improvements.

PAN-OS Log Forwarding Setup And Configuration

Documentation and metadata improvements.

PAN-OS - Add Static Routes

Documentation and metadata improvements.

PAN-OS - Add Domains EDL To Anti-Spyware

Documentation and metadata improvements.

NetOps - Firewall Version and Content Upgrade

Documentation and metadata improvements.

PAN-OS - Extract IPs From Traffic Logs To Sinkhole

Documentation and metadata improvements.

PAN-OS - Delete Static Routes

Documentation and metadata improvements.

PAN-OS Commit Configuration

Documentation and metadata improvements.

PAN-OS - Create Or Edit Rule

Documentation and metadata improvements.

Scripts

PanoramaCVECoverage

Documentation and metadata improvements.

PanoramaSecurityPolicyMatchWrapper

Documentation and metadata improvements.

Related pull requests:
- 40523

Download

2.5.2 - 4049458 (July 3, 2025)

Integrations

Palo Alto Networks PAN-OS

Added support for pan-os-check-dynamic-updates-status command that checks for the latest available dynamic update versions and returns a list of latest available / currently installed content.
Added support for pan-os-download-latest-antivirus-update command that downloads the latest AntiVirus dynamic update.
Added support for pan-os-download-latest-gp-update command that downloads the latest GlobalProtect Clientless VPN dynamic update.
Added support for pan-os-download-latest-wildfire-update command that downloads the latest WildFire dynamic update.
Added support for pan-os-install-latest-antivirus-update command that installs the latest AntiVirus update.
Added support for pan-os-install-latest-gp-update command that installs the latest GlobalProtect Clientless VPN dynamic update.
Added support for pan-os-install-latest-wildfire-update command that installs the latest WildFire dynamic update.

Enhancements to Existing Commands

Added support for built-in polling in the pan-os-download-latest-content-update command for downloading App/Threat updates. When polling argument is set to true it will return the final results of the download operation and no longer needs to be checked with the pan-os-content-update-download-status command.
Added support for built-in polling in the pan-os-install-latest-content-update command for installing App/Threat updates. When polling argument is set to true it will return the final results of the install operation and no longer needs to be checked with the pan-os-content-update-install-status command.

Related pull requests:
- 40292

Download

2.5.1 - 4017734 (June 30, 2025)

Integrations

Palo Alto Networks PAN-OS

Added a new command to get the certificate information from Panorama or Firewall, as seen under Certificate Management:
- pan-os-get-certificate-info

Related pull requests:
- 40308

Download

2.4.2 - R3980324 (June 26, 2025)

Integrations

Palo Alto Networks PAN-OS

Documentation and metadata improvements.

Related pull requests:
- 40270

Download

2.4.1 - 3849419 (June 18, 2025)

Scripts

PanoramaCVECoverage

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 40221

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	July 27, 2020
Last Release	June 17, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.