Palo Alto Networks

Connect a PAN-OS firewall by saving its host and admin credentials, after exchanging them once for an API key.

Connect a Panorama instance by saving its host and admin credentials, after exchanging them once for an API key.

List the connected PAN-OS firewalls and Panorama instances.

Disconnect a PAN-OS firewall or Panorama instance: deletes the saved API key. Nothing on the device itself is changed.

List security policy rules on the connected PAN-OS firewall.

Read one security rule in full by name.

Create a new security policy rule on the connected PAN-OS firewall. This does not take effect until you commit.

Update an existing security rule's action and/or enabled status. This does not take effect until you commit.

Permanently delete a security policy rule. This does not take effect until you commit.

Move a security rule before or after another rule in the rulebase. This does not take effect until you commit.

List address objects (IP/CIDR/range/FQDN) defined on the connected PAN-OS firewall.

Create a new address object (ip-netmask, ip-range, or fqdn). This does not take effect until you commit.

Update an existing address object's value. Infers ip-netmask vs fqdn from the new value's shape -- to change ip-range/fqdn use delete+create instead. This does not take effect until you commit.

Permanently delete an address object by name. This does not take effect until you commit.

List address groups (named collections of address objects) defined on the connected PAN-OS firewall.

List service (port) objects defined on the connected PAN-OS firewall.

Create a new service (port) object on the connected PAN-OS firewall.

Update a service object's port range. To change protocol, delete and recreate instead.

Permanently delete a service object by name.

List security zones configured on the connected PAN-OS firewall.

List network interfaces configured on the connected PAN-OS firewall.

Read the connected PAN-OS firewall's own system status: hostname, model, serial, software version, uptime.

Commit the connected PAN-OS firewall's pending configuration changes so they take effect. Firewall config edits (security rules, address/service objects) sit uncommitted until this runs -- same explicit-commit convention as ZIA's activate_zia_changes.

List device groups configured on the connected Panorama.

List FortiGate-equivalent PAN-OS devices managed by the connected Panorama.

Read one Panorama-managed PAN-OS device in full by serial number.

List configuration templates defined on the connected Panorama.

List security (pre/post) rules configured for a Panorama device group.

Push a Panorama device group's configuration out to its managed devices -- same as the 'Push' button in the Panorama web UI.

Enable or disable several PAN-OS security rules in one call, by explicit rule names. Continues past per-item failures and reports each outcome, same convention as every other bulk_* tool in the portfolio.

Run a read-only health audit across all connected PAN-OS/Panorama connections: disabled security rules with broad 'any' source/destination, offline Panorama-managed devices, and rules with no logging configured. Same convention as Fortinet Connector's audit_fortinet_estate.