[OSCD Initiative] Develop Responder for Palo Alto NGFW

[yugoslavskiy]

Feature description

Responder for Palo Alto NGFW that would be able to execute the following Response Actions:

• RA3101: Block external IP address
• RA3102: Block internal IP address
• RA3103: Block external domain
• RA3104: Block internal domain
• RA3105: Block external URL
• RA3106: Block internal URL
• RA3107: Block port external communication
• RA3108: Block port internal communication
• RA3109: Block user external communication
• RA3110: Block user internal communication
• RA5101: Unblock blocked IP
• RA5102: Unblock blocked domain
• RA5103: Unblock blocked URL
• RA5104: Unblock blocked port
• RA5105: Unblock blocked user

Describe the solution you'd like

Access to Palo Alto NGFW via its API using one of the following projects:

• pan-python
• pandevice

or any other alternatives.

Additional context

Most probably the listed Response Actions will require pre-configured Security Policies (rules) that would be 1:1 mapped to the Response Actions. This way Cortext will just update these rules during the execution.

[yugoslavskiy]

Hello @jeromeleonard ! Are you going to work on the issue? I am also interested in this one, how about a collab? (:

[Konakin]

Hello.
today, i got access to Palo Alto NGFW and i want create TheHive Responders. And i agree to collab :)
I can write to telegram.

[Konakin]

https://github.com/staf711/oscd_thehive_PaloAltoNGFW

[Konakin]

hello.
i want complete all responser today.

[Konakin]

i have problems with:

1. Block user
2. Unblock user
   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/user-id-features/dynamic-user-groups
   in my test Palo Alto NGFW don't have any user and i can't step 5 in instruction (Register Users).

and i have problem with "Unblock blocked URL". I don't khown how delete url in list, but add i can.

If you know how to solve tihs problems, please tell me.

[Konakin]

Hello.
Plese see pull#886.

next step: change logic and add rules for:

1. IP address
2. domains
3. URL(s)
4. ports
5. users

[yugoslavskiy]

Hello @Konakin! I've commented on your PR (: Let's proceed with the discussion there.

[jeromeleonard]

Thank you for your PR. We merged the related PR. Please consider translating the readme file from RU to EN.

Thanks.

[staf711]

@jeromeleonard, hi.
Sory i am late, but i translated README for PaloAlto responder #1025