riposte-marketplace/integrations/panos/manifest.yaml

id: panos
name: PAN-OS / Panorama
version: 1.0.0
description: "Palo Alto Networks PAN-OS / Panorama (XML API) — firewall containment: register/unregister IP tags for Dynamic Address Groups (fast block, no commit), create/delete address objects, create/edit custom URL categories, list and refresh External Dynamic Lists, and commit. API-key authentication; stdlib-only, no extra Python dependencies. Targets a firewall vsys."
changelog: "1.0.0 — Initial release: register/unregister IP tag, address create/delete, custom URL category create/edit, EDL list/refresh, commit."
category: network

# Per-instance configuration. The API key is sent as the 'key' query parameter.
# vsys is the firewall virtual system (default vsys1).
config_schema:
  properties:
    server:
      type: string
      description: "PAN-OS / Panorama URL (e.g. https://192.168.0.1)"
    api_key:
      type: string
      description: "PAN-OS API key"
      x-soar-sensitive: true
    port:
      type: number
      description: "HTTPS port (default 443)"
      default: 443
    vsys:
      type: string
      description: "Virtual system (default vsys1)"
      default: "vsys1"
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - server
    - api_key

commands:
  - id: register_ip_tag
    name: panos-register-ip-tag
    description: "Register (tag) an IP address so a Dynamic Address Group matching the tag blocks it immediately — no commit required."
    inputs_schema:
      properties:
        ip: { type: string, description: "IP address to tag" }
        tags: { type: string, description: "Comma-separated tags to attach" }
        timeout: { type: number, description: "Tag timeout in seconds (0 or empty = no timeout)" }
      required: [ip, tags]
    outputs_schema: { properties: {} }
  - id: unregister_ip_tag
    name: panos-unregister-ip-tag
    description: "Remove tags from an IP address (releases it from tag-based Dynamic Address Groups)."
    inputs_schema:
      properties:
        ip: { type: string, description: "IP address to untag" }
        tags: { type: string, description: "Comma-separated tags to remove" }
      required: [ip, tags]
    outputs_schema: { properties: {} }
  - id: create_address
    name: panos-create-address
    description: "Create an address object (ip-netmask, ip-range, or fqdn)."
    inputs_schema:
      properties:
        name: { type: string, description: "Address object name" }
        value: { type: string, description: "Address value (e.g. 10.0.0.5/32, 10.0.0.1-10.0.0.9, or bad.example.com)" }
        type: { type: string, description: "Address type: ip-netmask (default), ip-range, or fqdn" }
        description: { type: string, description: "Optional description" }
      required: [name, value]
    outputs_schema: { properties: {} }
  - id: delete_address
    name: panos-delete-address
    description: "Delete an address object by name."
    inputs_schema:
      properties:
        name: { type: string, description: "Address object name" }
      required: [name]
    outputs_schema: { properties: {} }
  - id: create_custom_url_category
    name: panos-create-custom-url-category
    description: "Create a custom URL category populated with the given URLs (used by a URL-filtering deny rule)."
    inputs_schema:
      properties:
        name: { type: string, description: "Custom URL category name" }
        urls: { type: string, description: "Comma-separated URLs/domains to include" }
        description: { type: string, description: "Optional description" }
      required: [name, urls]
    outputs_schema: { properties: {} }
  - id: edit_custom_url_category
    name: panos-edit-custom-url-category
    description: "Replace the URL list of an existing custom URL category."
    inputs_schema:
      properties:
        name: { type: string, description: "Custom URL category name" }
        urls: { type: string, description: "Comma-separated URLs/domains that become the category's full list" }
      required: [name, urls]
    outputs_schema: { properties: {} }
  - id: list_edl
    name: panos-list-edl
    description: "List External Dynamic Lists configured on the device."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: refresh_edl
    name: panos-refresh-edl
    description: "Force an immediate refresh of an External Dynamic List."
    inputs_schema:
      properties:
        name: { type: string, description: "External Dynamic List name" }
      required: [name]
    outputs_schema: { properties: {} }
  - id: commit
    name: panos-commit
    description: "Commit the candidate configuration."
    inputs_schema:
      properties:
        description: { type: string, description: "Optional commit description" }
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: panos-test-connection
    description: "Verify connectivity and the API key (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }