Palo Alto Networks Integration Guide

Overview

The Palo Alto Networks integration connects your NINA workflows to PAN-OS firewalls and Panorama management systems for comprehensive network security automation. This integration lets you manage firewall address objects, create custom URL categories for domain blocking, configure security policies to deny or drop traffic, and commit configuration changes — all directly from your workflows.

Palo Alto Networks provides industry-leading next-generation firewalls with advanced threat prevention capabilities. The NINA integration provides a streamlined way to automate firewall configuration and security policy management in your security operations workflows.

Status

We currently support 4 resources across the core PAN-OS REST API surface:

Address Objects: Create and manage IP addresses, subnets, IP ranges, and FQDN (domain) objects for use in security policies
URL Categories: Create and manage custom URL categories with domain lists for web filtering and blocking
Security Policies: Create and manage security policy rules to deny, drop, or reset traffic based on source IP, User-ID, zones, applications, and services
System Configuration: Commit pending configuration changes to activate them on the firewall

Important Notes

PAN-OS Version: This integration requires PAN-OS 11.0 or later with REST API support
API Access: The REST API must be enabled on your firewall or Panorama (Device > Setup > Management)
Commit Required: All configuration changes (address objects, URL categories, security policies) must be committed to take effect
Virtual Systems: Firewalls support virtual systems (vsys) for multi-tenancy; most objects can be created in shared or a specific vsys context

Not Currently Supported

NAT Policies: Network address translation rules
Application Override Policies: Port-based application identification overrides
Decryption Policies: SSL/TLS inspection and decryption rules
DoS Protection Policies: Denial-of-service protection profiles
QoS Policies: Quality of service and bandwidth management
Zone Protection: Zone-level protection profiles
Threat Prevention: Antivirus, anti-spyware, vulnerability protection, file blocking, and WildFire profiles
Dynamic Address Groups: Address groups with dynamic membership based on tags
GlobalProtect: VPN gateway and portal configuration
Device Groups (Panorama): Management of device groups and templates in Panorama
Logs and Reports: Log querying, traffic analysis, and threat reports
High Availability: HA pair configuration and management

For comprehensive information about PAN-OS capabilities, refer to the official documentation at https://docs.paloaltonetworks.com/

Credential Configuration

Before using the Palo Alto Networks integration in your workflows, you need to configure API key authentication credentials.

Authentication Method

The Palo Alto Networks integration uses API Key authentication:

Field	Description	Example
API Key	PAN-OS API Key	`LUFRPT14MW5xOEo1R09KVlBZNnpnem...`
Base URL	Firewall or Panorama URL	`https://firewall.example.com` or `https://10.10.10.10`

Generating an API Key

There are two methods to generate a PAN-OS API key:

Method 1: Using the Web UI (PAN-OS 9.0+)

Log in to your PAN-OS firewall or Panorama web interface
Navigate to the top-right corner and click your username
Select API Keys from the dropdown menu
Click Generate API Key
Copy and save the displayed key securely
Note: API keys inherit the permissions of the user account that generated them

Method 2: Using the XML API

curl -k 'https://firewall.example.com/api/?type=keygen&user=admin&password=yourpassword'

The response will contain your API key:

<response status="success">
  <result>
    <key>LUFRPT14MW5xOEo1R09KVlBZNnpnem...</key>
  </result>
</response>

Extract the key value between the <key> tags.

Required Permissions

The user account used to generate the API key should have the following minimum permissions:

Permission area	Required for
XML API Read/Write — Objects	Address objects and URL categories
XML API Read/Write — Policies	Security policies
Commit	Activating configuration changes

For production use, create a dedicated service account with role-based access control:

Navigate to Device > Administrators
Click Add to create a new administrator
Assign an appropriate admin role or configure a custom role via Device > Admin Roles

Creating a Palo Alto Networks Credential in NINA

Navigate to the Credentials section in NINA
Click Add New Credential
Fill in the credential details:
- Name: A descriptive name (e.g., "Palo Alto Production Firewall")
- Description: Optional details about the credential's purpose
- Integration Service: Select "Palo Alto Networks"
- Auth Type: "API Key" (only option available)
- API Key: Paste your PAN-OS API key
- Base URL: Enter your firewall or Panorama URL (e.g., https://firewall.example.com)
Click Test Connection to verify credentials
Click Save to store the credential

Base URL format requirements:

Must include https:// protocol (HTTP is automatically upgraded to HTTPS)
Port can be specified for non-standard ports (e.g., https://firewall.example.com:8443)
No trailing slash
Must point to the management interface, not a data interface

Supported Resources and Operations

Address Objects

Manage IP addresses, subnets, ranges, and FQDN objects for use in security policies and rules.

Operation	Name	Description
`create`	Create Address Object	Create a new address object (IP/netmask, IP range, or FQDN)
`list`	List Address Objects	Retrieve all address objects
`get`	Get Address Object	Get details of a specific address object
`update`	Update Address Object	Update an existing address object (modify value, description, tags)
`delete`	Delete Address Object	Delete an address object

Key parameters for create / update:

name (required) — unique name for the address object; no spaces or special characters (use underscores or hyphens)
type (required) — ip-netmask, ip-range, or fqdn
value (required) — address value matching the chosen type
description — optional description for audit trail
tags — array of tag strings for categorization (e.g., ["Blocked", "Phishing"])
location — shared (default, available to all vsys) or vsys
vsys — virtual system name when location is vsys (default: vsys1)

Key parameters for list / get / delete:

name (required for get and delete) — address object name
location — shared or vsys
vsys — virtual system name when location is vsys

Address Object Types:

ip-netmask: Single IP or subnet in CIDR notation (e.g., 192.168.1.1/32, 10.0.0.0/8)
ip-range: Range of IP addresses (e.g., 192.168.1.1-192.168.1.100)
fqdn: Fully qualified domain name (e.g., malicious-domain.com, *.example.com)

URL Categories

Manage custom URL categories for domain-based web filtering and blocking.

Operation	Name	Description
`create`	Create URL Category	Create a custom URL category with a list of domains
`list`	List URL Categories	Retrieve all custom URL categories
`get`	Get URL Category	Get details of a specific custom URL category
`update`	Update URL Category	Update the domains in a custom URL category (replaces entire list)
`delete`	Delete URL Category	Delete a custom URL category

Key parameters for create / update:

name (required) — unique name for the URL category
domains (required) — array of domains/URL patterns to include; supports wildcards (*.example.com)
description — optional description
location — shared (default) or vsys
vsys — virtual system name when location is vsys

Key parameters for list / get / delete:

name (required for get and delete) — URL category name
location — shared or vsys
vsys — virtual system name when location is vsys

Note: The update operation replaces the entire domain list. Include all existing domains plus any new ones to avoid accidentally removing entries.

Security Policies

Manage security policy rules to control traffic flow based on multiple criteria.

Operation	Name	Description
`create`	Create Security Policy	Create a security policy rule to deny or control traffic
`list`	List Security Policies	Retrieve all security policy rules
`get`	Get Security Policy	Get details of a specific security policy rule
`update`	Update Security Policy	Update an existing security policy rule
`delete`	Delete Security Policy	Delete a security policy rule

Key parameters for create / update:

name (required) — unique name for the rule; no spaces or special characters
action (required) — deny, drop, reset-client, reset-server, or reset-both
sourceAddresses (required for create) — array of source addresses or address object names; use ["any"] to match all
sourceUsers — array of User-ID entries for user-based blocking (e.g., ["DOMAIN\\username"]); use ["any"] for all users
destinationAddresses — array of destination addresses; use ["any"] for all
fromZones — source security zone names; use ["any"] for all zones
toZones — destination security zone names; use ["any"] for all zones
applications — application names; use ["any"] for all applications
services — service/port names; use ["any"] for all services
description — optional description for the rule
logStart — log at session start (default: true)
logEnd — log at session end (default: true)
location — vsys (only option for security policies)
vsys — virtual system name (default: vsys1)

Key parameters for list / get / delete:

name (required for get and delete) — rule name
location — vsys
vsys — virtual system name

Policy Actions:

Value	Description
`deny`	Silent drop — no response sent to client
`drop`	Drop and send ICMP unreachable (IP) or TCP reset (TCP)
`reset-client`	Send TCP reset to client only
`reset-server`	Send TCP reset to server only
`reset-both`	Send TCP reset to both client and server

Note: Security policies are evaluated top-to-bottom. Rules created via the API are appended to the end of the rulebase by default. Plan rule ordering carefully to avoid unintended matches.

System Configuration

System-level operations for managing firewall configuration state.

Operation	Name	Description
`commit`	Commit Configuration	Commit all pending configuration changes to activate them

Key parameters for commit:

description — optional commit description for the audit trail

Note: All configuration changes (address objects, URL categories, security policies) remain pending until committed. Commits are atomic — if validation fails, no changes are applied. Commits may take 30–60 seconds to complete on busy firewalls and return a job ID.

Parameter Merging and Templating

The Palo Alto Networks integration takes full advantage of NINA's parameter merging and templating capabilities:

Parameter Sources (in order of precedence)

Node Parameters: Parameters configured directly in the Palo Alto Integration Node
Extracted Parameters: Parameters automatically extracted from the input data
Input Data: The complete input data from upstream nodes

When a Palo Alto Integration Node executes:

It combines parameters from all sources
Node parameters take precedence over extracted parameters
Template variables within parameters are processed using {{variable_name}} syntax
The combined parameters are used to execute the Palo Alto operation

Example: Managing Address Objects

Creating an IP Address Object

Block a malicious IP address by creating an address object:

{
  "integration_service": "paloalto",
  "resource": "addressObjects",
  "operation": "create",
  "parameters": {
    "name": "Malicious_IP_203.0.113.42",
    "type": "ip-netmask",
    "value": "203.0.113.42/32",
    "description": "Malicious IP identified in phishing campaign - 2024-01-15",
    "tags": ["Blocked", "Phishing", "Threat-Intel"],
    "location": "shared"
  }
}

Creating a Domain (FQDN) Object

Block a malicious domain with dynamic input from an upstream node:

Input Data from Previous Node:

{
  "indicator": {
    "type": "domain",
    "value": "malicious-domain.evil",
    "threat_actor": "APT29",
    "campaign": "SolarWinds"
  }
}

Node Configuration:

{
  "integration_service": "paloalto",
  "resource": "addressObjects",
  "operation": "create",
  "parameters": {
    "name": "Domain_{{indicator.threat_actor}}_C2",
    "type": "fqdn",
    "value": "{{indicator.value}}",
    "description": "C2 domain for {{indicator.threat_actor}} — campaign: {{indicator.campaign}}",
    "tags": ["Blocked", "C2", "{{indicator.threat_actor}}"],
    "location": "shared"
  }
}

Creating an IP Range Object

Block an entire range of malicious IP addresses:

{
  "integration_service": "paloalto",
  "resource": "addressObjects",
  "operation": "create",
  "parameters": {
    "name": "Suspicious_IP_Range",
    "type": "ip-range",
    "value": "198.51.100.1-198.51.100.50",
    "description": "Hosting provider subnet associated with malicious activity",
    "tags": ["Blocked", "Hosting"],
    "location": "shared"
  }
}

Listing Address Objects

{
  "integration_service": "paloalto",
  "resource": "addressObjects",
  "operation": "list",
  "parameters": {
    "location": "shared"
  }
}

Updating an Address Object

{
  "integration_service": "paloalto",
  "resource": "addressObjects",
  "operation": "update",
  "parameters": {
    "name": "Malicious_IP_203.0.113.42",
    "type": "ip-netmask",
    "value": "203.0.113.42/32",
    "description": "Updated: Confirmed active C2 server - block immediately",
    "tags": ["Blocked", "Phishing", "Threat-Intel", "Active-C2"],
    "location": "shared"
  }
}

Deleting an Address Object

{
  "integration_service": "paloalto",
  "resource": "addressObjects",
  "operation": "delete",
  "parameters": {
    "name": "Malicious_IP_203.0.113.42",
    "location": "shared"
  }
}

Example: Managing URL Categories

Creating a Custom URL Category

{
  "integration_service": "paloalto",
  "resource": "urlCategories",
  "operation": "create",
  "parameters": {
    "name": "Malware_Distribution_Sites",
    "domains": [
      "malicious-domain1.com",
      "evil-site.net",
      "*.phishing-domain.org",
      "c2-server.xyz"
    ],
    "description": "Domains identified as malware distribution sites from threat intel feeds",
    "location": "shared"
  }
}

Creating a URL Category from a Threat Feed

Input Data from Previous Node:

{
  "threat_feed": {
    "category": "ransomware",
    "domains": [
      "ransom-payment-portal.onion.ly",
      "lockbit-leak-site.com",
      "blackcat-data-dump.net"
    ],
    "confidence": "high",
    "source": "FBI Flash Alert"
  }
}

Node Configuration:

{
  "integration_service": "paloalto",
  "resource": "urlCategories",
  "operation": "create",
  "parameters": {
    "name": "Ransomware_{{threat_feed.category}}_Domains",
    "domains": "{{threat_feed.domains}}",
    "description": "Ransomware domains from {{threat_feed.source}} — Confidence: {{threat_feed.confidence}}",
    "location": "shared"
  }
}

Updating a URL Category

{
  "integration_service": "paloalto",
  "resource": "urlCategories",
  "operation": "update",
  "parameters": {
    "name": "Malware_Distribution_Sites",
    "domains": [
      "malicious-domain1.com",
      "evil-site.net",
      "*.phishing-domain.org",
      "c2-server.xyz",
      "new-threat-domain1.com",
      "new-threat-domain2.net"
    ],
    "description": "Updated with new threat intelligence - 2024-01-15",
    "location": "shared"
  }
}

Example: Managing Security Policies

Blocking an IP Address

Create a security policy rule to deny all traffic from a specific IP:

{
  "integration_service": "paloalto",
  "resource": "securityPolicies",
  "operation": "create",
  "parameters": {
    "name": "Block_Malicious_IP_203_0_113_42",
    "action": "deny",
    "sourceAddresses": ["Malicious_IP_203.0.113.42"],
    "destinationAddresses": ["any"],
    "fromZones": ["any"],
    "toZones": ["any"],
    "applications": ["any"],
    "services": ["any"],
    "description": "Block all traffic from confirmed malicious IP",
    "logStart": true,
    "logEnd": true,
    "location": "vsys",
    "vsys": "vsys1"
  }
}

Blocking by User-ID (Compromised Account)

Block network access for a compromised user account:

Input Data:

{
  "incident_id": "INC-2026-0042",
  "compromised_user": "DOMAIN\\john.doe",
  "analyst": "[email protected]"
}

Node Configuration:

{
  "integration_service": "paloalto",
  "resource": "securityPolicies",
  "operation": "create",
  "parameters": {
    "name": "Block_Compromised_User_{{incident_id}}",
    "action": "drop",
    "sourceUsers": ["{{compromised_user}}"],
    "sourceAddresses": ["any"],
    "destinationAddresses": ["any"],
    "fromZones": ["trust"],
    "toZones": ["untrust"],
    "applications": ["any"],
    "services": ["any"],
    "description": "Emergency block for compromised account — {{incident_id}} — authorized by {{analyst}}",
    "logStart": true,
    "logEnd": true,
    "location": "vsys",
    "vsys": "vsys1"
  }
}

Isolating a Compromised Device

Block all outbound traffic from a potentially compromised device:

{
  "integration_service": "paloalto",
  "resource": "securityPolicies",
  "operation": "create",
  "parameters": {
    "name": "Isolate_Device_10_10_50_100",
    "action": "reset-both",
    "sourceAddresses": ["10.10.50.100/32"],
    "destinationAddresses": ["any"],
    "fromZones": ["trust"],
    "toZones": ["any"],
    "applications": ["any"],
    "services": ["any"],
    "description": "Device isolation — suspected ransomware infection",
    "logStart": true,
    "logEnd": true,
    "location": "vsys",
    "vsys": "vsys1"
  }
}

Creating a Zone-Based Security Policy

Block traffic between specific security zones:

{
  "integration_service": "paloalto",
  "resource": "securityPolicies",
  "operation": "create",
  "parameters": {
    "name": "Block_Guest_to_Internal",
    "action": "deny",
    "sourceAddresses": ["any"],
    "destinationAddresses": ["any"],
    "fromZones": ["guest"],
    "toZones": ["trust", "dmz"],
    "applications": ["any"],
    "services": ["any"],
    "description": "Prevent guest network access to internal zones",
    "logStart": true,
    "logEnd": true,
    "location": "vsys",
    "vsys": "vsys1"
  }
}

Example: Configuration Commit

After creating, updating, or deleting address objects, URL categories, or security policies, commit the changes to activate them:

{
  "integration_service": "paloalto",
  "resource": "system",
  "operation": "commit",
  "parameters": {
    "description": "Emergency IOC block — Incident #2024-001"
  }
}

Important Notes:

All configuration changes are pending until committed
Commit validates all changes before applying — if validation fails, nothing is applied (atomic)
Include a descriptive commit message for audit trail
Commits return a job ID; check firewall logs or the Operations panel if you need to verify completion

Common Workflow Patterns

Automated IOC Blocking

addressObjects.create — create an address object for the malicious IP or subnet
securityPolicies.create — create a deny rule referencing the address object
system.commit — activate the changes
Slack/Teams node — notify the security team

Phishing Response — Domain Blocking

Email analysis node — extract malicious domains from the phishing email
urlCategories.create — create a custom URL category with the extracted domains
system.commit — activate the URL category
Email node — notify the security team of blocked domains

Incident Response — Device Isolation

SIEM alert node — receive alert with device IP
securityPolicies.create — create a reset-both rule for the device IP
system.commit — activate isolation immediately
Ticket creation node — open an incident ticket

Compromised Account Response

Identity provider alert — receive notification of compromised credentials
securityPolicies.create — create a User-ID block policy for the affected account
system.commit — activate the policy
Identity provider node — disable the account
Notification node — alert the SOC and account owner

Bulk IOC Import

Schedule node — trigger on a regular schedule
File node — read an IOC CSV/JSON feed
Script node — parse and batch IOCs
Loop node — iterate over IOCs
addressObjects.create — create an address object per IOC
End loop
system.commit — single commit to activate all changes

Working with Virtual Systems

Palo Alto firewalls support virtual systems (vsys) for multi-tenancy and logical separation.

Shared vs. Virtual System Context

Context	`location` value	Use case
Shared	`shared`	Objects available to all virtual systems
Virtual system	`vsys`	Objects specific to a named vsys

Default behavior:

Address Objects and URL Categories: location: "shared" (available to all vsys)
Security Policies: location: "vsys", vsys: "vsys1" (most common default)

Creating an Object in a Specific Virtual System

{
  "integration_service": "paloalto",
  "resource": "addressObjects",
  "operation": "create",
  "parameters": {
    "name": "Department_Server",
    "type": "ip-netmask",
    "value": "10.20.30.40/32",
    "description": "Department-specific server",
    "location": "vsys",
    "vsys": "vsys2"
  }
}

Response Structure Examples

Address Object Creation Response

{
  "@status": "success",
  "@code": "20",
  "result": {
    "@count": "1",
    "@total-count": "1",
    "entry": {
      "@name": "Malicious_IP_203.0.113.42",
      "@location": "shared",
      "ip-netmask": "203.0.113.42/32",
      "description": "Malicious IP identified in phishing campaign",
      "tag": {
        "member": ["Blocked", "Phishing", "Threat-Intel"]
      }
    }
  }
}

Security Policy Creation Response

{
  "@status": "success",
  "@code": "20",
  "result": {
    "@count": "1",
    "@total-count": "1",
    "entry": {
      "@name": "Block_Malicious_IP_203_0_113_42",
      "@location": "vsys",
      "@vsys": "vsys1",
      "from": { "member": ["any"] },
      "to": { "member": ["any"] },
      "source": { "member": ["Malicious_IP_203.0.113.42"] },
      "destination": { "member": ["any"] },
      "action": "deny",
      "log-start": "yes",
      "log-end": "yes"
    }
  }
}

Commit Response

{
  "@status": "success",
  "@code": "19",
  "result": {
    "msg": {
      "line": "Configuration committed successfully"
    },
    "job": "1234"
  }
}

The job field contains the commit job ID. For large commits, check Monitor > Logs > System or Device > Setup > Operations > Show Jobs in the PAN-OS web interface to verify completion.

Troubleshooting

Issue	Resolution
Authentication failed	Verify the API key is valid and hasn't been regenerated. Check the base URL is correct and the management interface is accessible.
Permission denied	Ensure the user account that generated the API key has XML API access to Objects, Policies, and Commit.
Object already exists	An object with the same name already exists. Use the `update` operation instead, or delete the existing object first.
Commit failed	Check firewall logs for validation errors — common causes: referenced objects don't exist, invalid configuration, or conflicting rules.
Connection timeout	Verify network connectivity to the management interface and confirm the REST API is enabled.
Invalid object name	Object names cannot contain spaces or special characters. Use underscores or hyphens.
Referenced object not found	Address objects must exist before being referenced in security policies.
Changes not taking effect	Configuration changes require a `system.commit` to activate.
REST API not available	Ensure PAN-OS 11.0 or later is running and the REST API is enabled in `Device > Setup > Management`.
Virtual system not found	Verify the vsys name is correct. Check `Device > Virtual Systems` for the list of configured vsys.

Common Error Messages

Error Message	Meaning	Solution
`"authentication failed: invalid API key"`	The API key is incorrect or has been regenerated	Generate a new API key and update the NINA credential
`"failed to connect to PaloAlto API"`	Network connectivity or URL issue	Verify the base URL, firewall accessibility, and network path
`"Object already exists"`	Duplicate object name	Use a different name or update the existing object
`"Invalid reference to object"`	Policy references a non-existent address object	Create the address object before creating the policy
`"Configuration validation failed"`	Commit failed validation	Review the error details from the commit response and resolve
`"API returned non-success status"`	General API validation failure	Check the error details in the response for specific issues

Best Practices

Use descriptive names: Name objects and policies to convey purpose (e.g., Block_Malicious_IP_203_0_113_42 rather than Rule_1).
Tag everything: Apply consistent tags for easy management and policy reference (e.g., Blocked, Phishing, C2, APT29).
Document sources and dates: Include the threat intelligence source and date in descriptions to support audit trails and reviews.
Batch changes before committing: Group multiple create/update/delete operations and commit once to reduce configuration churn and firewall load.
Always include commit descriptions: Descriptive commit messages aid troubleshooting, audits, and change management reviews.
Plan rule order carefully: Security policies are evaluated top-to-bottom; rules added via the API are appended to the end. Ensure more specific rules take precedence over broader ones.
Use shared context for cross-vsys objects: Create address objects and URL categories in shared when they need to be referenced across multiple virtual systems.
Enable logging on blocked traffic: Set logStart: true and logEnd: true on deny/drop rules for complete audit trail and incident investigation capability.
Use template variables for dynamic workflows: Use {{variable_name}} syntax to pass IOC values, incident IDs, and user names from upstream nodes dynamically.
Verify commit completion: For critical changes, check the PAN-OS job status via Monitor > Logs > System rather than assuming the commit succeeded.
Clean up stale objects: Regularly review and remove unused address objects, URL categories, and policies to keep the rulebase maintainable.
Test in a lab environment: Validate policy changes in a non-production firewall before deploying to production.

Security Considerations

Protect API keys: Store credentials exclusively through NINA's credential manager. Never include API keys in workflow parameters, logs, or comments.
Use dedicated service accounts: Create a dedicated administrator account for this integration rather than using shared credentials. This limits the blast radius if credentials are compromised and enables per-integration audit trails.
Apply minimum required permissions: Grant only the permissions needed for your workflows — if no commits are required, remove commit access. If only read operations are needed, use a read-only admin role.
Audit machine action equivalents: Security policy creation and commits have direct operational impact. Implement workflow-level approval gates for changes that block or isolate production traffic.
Rotate API keys periodically: API keys do not expire automatically, but should be rotated on a regular schedule. Update the NINA credential after rotation.
Restrict management interface access: Ensure the PAN-OS management interface is not exposed to untrusted networks. Use out-of-band management networks where possible.
Review created policies regularly: Automated workflows can accumulate a large number of block rules. Implement cleanup workflows to remove outdated IOC-based rules to prevent rulebase bloat and maintain performance.

PAN-OS Version Compatibility

This integration uses the PAN-OS REST API and requires:

PAN-OS 11.0 or later on your firewall or Panorama
REST API enabled in Device > Setup > Management > Management Interface Settings
HTTPS management access configured on the management interface

To check your PAN-OS version: log in to the web interface and look at the bottom-left corner, or navigate to Device > Software.

Additional Resources

PAN-OS REST API Documentation: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-panorama-api
PAN-OS Administrator's Guide: https://docs.paloaltonetworks.com/pan-os
Security Policy Best Practices: https://docs.paloaltonetworks.com/best-practices
PAN-OS CLI Reference: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-cli-reference

Updated: 2026-05-27

Overview​

Status​

Important Notes​

Not Currently Supported​

Credential Configuration​

Authentication Method​

Generating an API Key​

Method 1: Using the Web UI (PAN-OS 9.0+)​

Method 2: Using the XML API​

Required Permissions​

Creating a Palo Alto Networks Credential in NINA​

Supported Resources and Operations​

Address Objects​

URL Categories​

Security Policies​

System Configuration​

Parameter Merging and Templating​

Parameter Sources (in order of precedence)​

Example: Managing Address Objects​

Creating an IP Address Object​

Creating a Domain (FQDN) Object​

Input Data from Previous Node:​

Node Configuration:​

Creating an IP Range Object​

Listing Address Objects​

Updating an Address Object​

Deleting an Address Object​

Example: Managing URL Categories​

Creating a Custom URL Category​

Creating a URL Category from a Threat Feed​

Input Data from Previous Node:​

Node Configuration:​

Updating a URL Category​

Example: Managing Security Policies​

Blocking an IP Address​

Blocking by User-ID (Compromised Account)​

Input Data:​

Node Configuration:​

Isolating a Compromised Device​

Creating a Zone-Based Security Policy​

Example: Configuration Commit​

Common Workflow Patterns​

Automated IOC Blocking​

Phishing Response — Domain Blocking​

Incident Response — Device Isolation​

Compromised Account Response​

Bulk IOC Import​

Working with Virtual Systems​

Shared vs. Virtual System Context​

Creating an Object in a Specific Virtual System​

Response Structure Examples​

Address Object Creation Response​

Security Policy Creation Response​

Commit Response​

Troubleshooting​

Common Error Messages​

Best Practices​

Security Considerations​

PAN-OS Version Compatibility​

Additional Resources​

Overview

Status

Important Notes

Not Currently Supported

Credential Configuration

Authentication Method

Generating an API Key

Method 1: Using the Web UI (PAN-OS 9.0+)

Method 2: Using the XML API

Required Permissions

Creating a Palo Alto Networks Credential in NINA

Supported Resources and Operations

Address Objects

URL Categories

Security Policies

System Configuration

Parameter Merging and Templating

Parameter Sources (in order of precedence)

Example: Managing Address Objects

Creating an IP Address Object

Creating a Domain (FQDN) Object

Input Data from Previous Node:

Node Configuration:

Creating an IP Range Object

Listing Address Objects

Updating an Address Object

Deleting an Address Object

Example: Managing URL Categories

Creating a Custom URL Category

Creating a URL Category from a Threat Feed

Input Data from Previous Node:

Node Configuration:

Updating a URL Category

Example: Managing Security Policies

Blocking an IP Address

Blocking by User-ID (Compromised Account)

Input Data:

Node Configuration:

Isolating a Compromised Device

Creating a Zone-Based Security Policy

Example: Configuration Commit

Common Workflow Patterns

Automated IOC Blocking

Phishing Response — Domain Blocking

Incident Response — Device Isolation

Compromised Account Response

Bulk IOC Import

Working with Virtual Systems

Shared vs. Virtual System Context

Creating an Object in a Specific Virtual System

Response Structure Examples

Address Object Creation Response

Security Policy Creation Response

Commit Response

Troubleshooting

Common Error Messages

Best Practices

Security Considerations

PAN-OS Version Compatibility

Additional Resources