diff --git a/CHANGELOG.md b/CHANGELOG.md index 5b68fa0..787cc33 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,28 @@ # Changelog +## 2023/04/18 - Version 0.26 +### Features Added +* Added Security Services + * Security Rules - Delete, Edit, Create, List + * Anti-Spyware Profiles - Delete, Edit, Create, List + * Anti-Spyware Signatures - Delete, Edit, Create, List + * Dns Security Profiles - Delete, Edit, Create, List + * Decryption Exclusions - Delete, Edit, Create, List + * Decryption Profiles - Delete, Edit, Create, List + * Decryption Rules - Delete, Edit, Create, List + * File-Blocking Profiles - Delete, Edit, Create, List + * Http-Header Profiles - Delete, Edit, Create, List + * Profile Groups - Delete, Edit, Create, List + * Url Access Profiles - Delete, Edit, Create, List + * Vulnerability Protect Profiles - Delete, Edit, Create, List + * Vulnerability Protect Signatures - Delete, Edit, Create, List + * Wildfire AntiVirus Profiles - Delete, Edit, Create, List +### Changes +* Add position arg to saseApi paList, paCreate, paEdit, paDelete to support Security Rules and Decryption Rules +* Update paList - a check for response type to return a list without further processing (For paLocationsListLocations which returns a list) +* Added name_key arg to paCreate, paEdit, paDelete to support Vuln & AntiSpam Signatures which have a different object name (threatname) + + ## 2023/01/26 - Version 0.25 * Added URL Filtering Categories - List. Please note that this is currently not working. diff --git a/README.md b/README.md index 94fe93e..8415083 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Prisma SASE Cloud Managed API Python framework to make changes to Prisma Access Cloud Managed -Current working version - _0.24_ +Current working version - _0.26_ * Authors - [TheScriptGuy](https://github.com/TheScriptGuy) @@ -43,7 +43,23 @@ See [CHANGELOG.md](https://github.com/PaloAltoNetworks/PrismaSASECloudManaged-Py | Prisma Access Locations | :white_check_mark: | n/a | n/a | n/a | | Infrastructure Settings | :white_check_mark: | n/a | :white_check_mark: | n/a | - +### Security Services +| Feature | List | Create | Edit | Delete | +| ------- | ---- | ------ | ---- | ------ | +| Security Rules | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Anti-Spyware Profiles | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Anti-Spyware Signatures | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Dns Security Profiles | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Decryption Exclusions | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Decryption Profiles | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Decryption Rules | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| File-Blocking Profiles | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Http-Header Profiles | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Profile Groups | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Url Access Profiles | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Vulnerability Protect Profiles | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Vulnerability Protect Signatures | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | +| Wildfire AntiVirus Profiles | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | # SDWAN Not supported (yet) @@ -53,4 +69,4 @@ How to use the API [Setup API Access in TSG](https://github.com/PaloAltoNetworks/PrismaSASECloudManaged-Python/blob/main/usage-identity-access.md) -[Python Script Usage](https://github.com/PaloAltoNetworks/PrismaSASECloudManaged-Python/blob/main/usage-python.md) \ No newline at end of file +[Python Script Usage](https://github.com/PaloAltoNetworks/PrismaSASECloudManaged-Python/blob/main/usage-python.md) diff --git a/access/policyObjects.py b/access/policyObjects.py index eecc31f..5306077 100644 --- a/access/policyObjects.py +++ b/access/policyObjects.py @@ -77,7 +77,7 @@ def paLicenseTypesListTypes(self): print("Please request new token and create new prismaAccess object.") def paLocationsListLocations(self): - """List all the Prisma Access Locations""" + """List all the Prisma Access Locations. This data is returned as a List""" if self.checkTokenStillValid(): paLocations = saseApi.saseApi(self.prismaAccessObject.locationsUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) paLocations.paList() diff --git a/access/prismaAccess.py b/access/prismaAccess.py index 9c7d9ec..de09da4 100644 --- a/access/prismaAccess.py +++ b/access/prismaAccess.py @@ -70,24 +70,24 @@ def initApiUri(self): #self.trafficSteeringUri = self.saseApi + __configV1 + "traffic-steering" # Security Services - #self.antiSpywareProfilesUri = self.saseApi + __configV1 + "anti-spyware-profiles" - #self.antiSpywareSignaturesUri = self.saseApi + __configV1 + "anti-spyware-signatures" - #self.dnsSecurityProfilesUri = self.saseApi + __configV1 + "dns-security-profiles" - #self.decryptionExclusionsUri = self.saseApi + __configV1 + "decryption-exclusions" - #self.decryptionProfilesUri = self.saseApi + __configV1 + "decryption-profiles" - #self.decryptionRulesUri = self.saseApi + __configV1 + "decryption-rules" - #self.fileBlockingProfilesUri = self.saseApi + __configV1 + "file-blocking-profiles" - #self.httpHeaderProfilesUri = self.saseApi + __configV1 + "http-header-profiles" - #self.profileGroupsUri = self.saseApi + __configV1 + "profile-groups" - #self.securityRulesUri = self.saseApi + __configV1 + "security-rules" - #self.urlAccessProfilesUri = self.saseApi + __configV1 + "url-access-profiles" - #self.vulnerabilityProtectProfilesUri = self.saseApi + __configV1 + "vulnerability-protection-profiles" - #self.vulnerabilityProtectSignaturesUri = self.saseApi + __configV1 + "vulnerability-protection-signatures" - #self.wildfireAntiVirusProfilesUri = self.saseApi + __configV1 + "wildfire-anti-virus-profiles" + self.antiSpywareProfilesUri = self.saseApi + __configV1 + "anti-spyware-profiles" + self.antiSpywareSignaturesUri = self.saseApi + __configV1 + "anti-spyware-signatures" + self.dnsSecurityProfilesUri = self.saseApi + __configV1 + "dns-security-profiles" + self.decryptionExclusionsUri = self.saseApi + __configV1 + "decryption-exclusions" + self.decryptionProfilesUri = self.saseApi + __configV1 + "decryption-profiles" + self.decryptionRulesUri = self.saseApi + __configV1 + "decryption-rules" + self.fileBlockingProfilesUri = self.saseApi + __configV1 + "file-blocking-profiles" + self.httpHeaderProfilesUri = self.saseApi + __configV1 + "http-header-profiles" + self.profileGroupsUri = self.saseApi + __configV1 + "profile-groups" + self.securityRulesUri = self.saseApi + __configV1 + "security-rules" + self.urlAccessProfilesUri = self.saseApi + __configV1 + "url-access-profiles" + self.vulnerabilityProtectProfilesUri = self.saseApi + __configV1 + "vulnerability-protection-profiles" + self.vulnerabilityProtectSignaturesUri = self.saseApi + __configV1 + "vulnerability-protection-signatures" + self.wildfireAntiVirusProfilesUri = self.saseApi + __configV1 + "wildfire-anti-virus-profiles" def __init__(self, __saseToken): """Initialize Class""" - self.prismaAccessPythonAPIVersion = "0.25" + self.prismaAccessPythonAPIVersion = "0.26" self.saseApi = "https://api.sase.paloaltonetworks.com" self.saseToken = __saseToken self.contentType = "application/json" @@ -97,4 +97,4 @@ def __init__(self, __saseToken): } # Set all API URI variables - self.initApiUri() \ No newline at end of file + self.initApiUri() diff --git a/access/saseApi.py b/access/saseApi.py index 5fca3c7..430ab12 100644 --- a/access/saseApi.py +++ b/access/saseApi.py @@ -3,45 +3,62 @@ class saseApi: """saseApi class""" - def paList(self, __folder="Shared", __displayOutput=True): + def paList(self, __folder="Shared", __position="pre", includePosition=False, __displayOutput=True): """ This will list the addresses from the folder. Folder defaults to shared. + Position is included in params if includePosition=True. Position defaults to pre. """ __params = { "folder": __folder, "limit": self.saseLimit } - __response = requests.get(url=self.saseUri, headers=self.saseAuthHeaders, data=__dataPayload) + if includePosition: + __params["position"] = __position + __response = requests.get(url=self.saseUri, headers=self.saseAuthHeaders, params=__params) __response = __response.json() - if __response["total"] > self.saseLimit: - # There are more than self.saseLimit (default: 200) objects retrieved. We need to get through the entire list. - numRecords = 0 + if isinstance(__response, dict) and "total" in __response: + if __response["total"] > self.saseLimit: + # There are more than self.saseLimit (default: 200) objects retrieved. We need to get through the entire list. + numRecords = 0 - while numRecords < __response["total"]: - """ - Perform all API queries until we've retrieved all objects. - """ - numRecords = len(__response["data"]) + while numRecords < __response["total"]: + """ + Perform all API queries until we've retrieved all objects. + """ + numRecords = len(__response["data"]) - # Update the offset to reflect the number of records already retrieved. - __params2 = { "folder": __folder, "offset": numRecords, "limit": self.saseLimit } + # Update the offset to reflect the number of records already retrieved. + __params2 = { "folder": __folder, "offset": numRecords, "limit": self.saseLimit } + if includePosition: + __params2["position"] = __position - __response2 = requests.get(url=self.saseUri, headers=self.saseAuthHeaders, params=__params2) - __response2 = __response2.json() + __response2 = requests.get(url=self.saseUri, headers=self.saseAuthHeaders, params=__params2) + __response2 = __response2.json() - if "data" in __response2: - # Append the next batch of application objects to the original data object that we retrieved from __response. - __response["data"] = [*__response["data"], *(__response2["data"])] + if "data" in __response2: + # Append the next batch of application objects to the original data object that we retrieved from __response. + __response["data"] = [*__response["data"], *(__response2["data"])] + + elif isinstance(__response, list): + # The endpoint returned a list. We do not need to perform any additional API queries. + pass + + else: + # Unexpected response type, raise an error + raise ValueError("Unexpected response type") if __displayOutput: # We need to display the output to stdout. print(__response) return __response - def paCreate(self, __jsonObject, __folder="Shared"): + def paCreate(self, __jsonObject, __folder="Shared", __position="pre", includePosition=False, name_key='name'): """ This will create an object (by default in Shared) + name_key is included in params to add the ability to define a new name key for cases where 'name' isn't passed in the payload (AntiSpyware/VulnerabilityProtect Signatures) """ __params = { "folder": __folder } + if includePosition: + __params["position"] = __position __response = requests.post(url=self.saseUri, headers=self.saseAuthHeaders, json=__jsonObject, params=__params) __responseStatusCode = __response.status_code __response = __response.json() @@ -50,17 +67,17 @@ def paCreate(self, __jsonObject, __folder="Shared"): case 404: print(f"jsonobject = {__jsonObject}") print(f"response = {__response}") - print(f"404 - An error occured while creating object {__jsonObject['name']} - {__response['_errors'][0]['details']['message']} in folder {__folder}") + print(f"404 - An error occured while creating object {__jsonObject[name_key]} - {__response['_errors'][0]['details']['message']} in folder {__folder}") case 400: print("400 - Bad request. Malformed payload.") case 201: - print(f"201 - Object {__jsonObject['name']} created in folder {__folder}.") + print(f"201 - Object {__jsonObject[name_key]} created in folder {__folder}.") case _: print("Not sure how to interpret response.") print(f"Response Status Code - {__responseStatusCode}") print(f"json response = {__response}") - def paEdit(self, __jsonObject, __folder="Shared"): + def paEdit(self, __jsonObject, __folder="Shared", __position="pre", includePosition=False, name_key='name'): """ This will edit an existing object (by default in Shared) If your object references something external from it e.g. an address-group referencing an address object, make sure the address is created first. @@ -68,17 +85,17 @@ def paEdit(self, __jsonObject, __folder="Shared"): 1. First is to get the unique ID for the address. 2. Once we have the unique ID, we can change the information about it (except the unique ID) """ - myList = self.paList(__folder,False) + myList = self.paList(__folder, __position, True, False) if includePosition else self.paList(__folder, False, False) myObjectId = "" if 'data' in myList: # Let's go and find the object ID for item in myList['data']: if __folder != "Service Connections": - if item['name'] == __jsonObject['name'] and item['folder'] == __folder: + if item[name_key] == __jsonObject[name_key] and item['folder'] == __folder: myObjectId = item['id'] break else: - if item['name'] == __jsonObject['name']: + if item[name_key] == __jsonObject[name_key]: myObjectId = item['id'] break @@ -86,17 +103,19 @@ def paEdit(self, __jsonObject, __folder="Shared"): # We should now have the ID. __editUri = self.saseUri + f"/{myObjectId}" __params = { "folder": __folder } + if includePosition: + __params["position"] = __position __response = requests.put(url=__editUri, headers=self.saseAuthHeaders, json=__jsonObject, params=__params) __responseStatusCode = __response.status_code __response = __response.json() match __responseStatusCode: case 404: - print(f"404 - An error occured while editing object {__jsonObject['name']} - {__response['_errors'][0]['details']['message']} in folder {__folder}.") + print(f"404 - An error occured while editing object {__jsonObject[name_key]} - {__response['_errors'][0]['details']['message']} in folder {__folder}.") case 400: print("400 - Bad request. Malformed payload.") case 200: - print(f"200 - Object {__jsonObject['name']} edited in folder {__folder}.") + print(f"200 - Object {__jsonObject[name_key]} edited in folder {__folder}.") case _: print("Not sure how to interpret response.") print(f"Response Status Code - {__responseStatusCode}") @@ -104,7 +123,7 @@ def paEdit(self, __jsonObject, __folder="Shared"): else: print(f"Unable to find object ID in {__folder}.") - def paDelete(self, __jsonObject, __folder="Shared"): + def paDelete(self, __jsonObject, __folder="Shared", __position="pre", includePosition=False, name_key='name'): """ This will delete an existing object (by default in Shared) The comments field are optional. @@ -116,17 +135,17 @@ def paDelete(self, __jsonObject, __folder="Shared"): 1. First is to get the unique ID for the address. 2. Once we have the unique ID, we can delete the address """ - myList = self.paList(__folder,False) + myList = self.paList(__folder, __position, True, False) if includePosition else self.paList(__folder, False, False) myObjectId = "" if 'data' in myList: # Let's go and find the address ID for item in myList['data']: if (__folder != "Service Connections") or (__folder != "Remote Networks"): - if item['name'] == __jsonObject['name'] and item['folder'] == __folder: + if item[name_key] == __jsonObject[name_key] and item['folder'] == __folder: myObjectId = item['id'] break else: - if item['name'] == __jsonObject['name']: + if item[name_key] == __jsonObject[name_key]: myObjectId = item['id'] break @@ -138,6 +157,8 @@ def paDelete(self, __jsonObject, __folder="Shared"): # We should now have the ID. __deleteUri = self.saseUri + f"/{myObjectId}" __params = { "folder": __folder } + if includePosition: + __params["position"] = __position __response = requests.delete(url=__deleteUri, headers=self.saseAuthHeaders, json=__jsonObject, params=__params) __responseStatusCode = __response.status_code __response = __response.json() @@ -146,11 +167,11 @@ def paDelete(self, __jsonObject, __folder="Shared"): case 409: print(f"409 - Cannot delete object being referenced {__response['_errors'][0]['details']['message']}") case 404: - print(f"404 - An error occured while creating object {__addresssObject['name']} - {__response['_errors'][0]['details']['message']} in folder {__folder}.") + print(f"404 - An error occured while creating object {__jsonObject[name_key]} - {__response['_errors'][0]['details']['message']} in folder {__folder}.") case 400: print("400 - Bad request. Malformed payload.") case 200: - print(f"200 - Object {__jsonObject['name']} deleted in folder {__folder}.") + print(f"200 - Object {__jsonObject[name_key]} deleted in folder {__folder}.") case _: print("Not sure how to interpret response.") print(f"Response Status Code - {__responseStatusCode}") diff --git a/access/securityServices.py b/access/securityServices.py index 5d24037..21a14c5 100644 --- a/access/securityServices.py +++ b/access/securityServices.py @@ -14,6 +14,399 @@ def checkTokenStillValid(self): tokenValid = bool(rightNow < self.prismaAccessObject.saseToken['expiresOn']) return tokenValid + def paSecurityRulesList(self, __folder="Shared", __position="pre"): + """List all security rules that are defined.""" + if self.checkTokenStillValid(): + paSecurityRules = saseApi.saseApi(self.prismaAccessObject.securityRulesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paSecurityRules.paList(__folder, __position, includePosition=True) + else: + print("Please request new token and create new prismaAccess object.") + + def paSecurityRulesCreate(self, __securityRuleObject, __folder="Shared", __position="pre"): + if self.checkTokenStillValid(): + paSecurityRules = saseApi.saseApi(self.prismaAccessObject.securityRulesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paSecurityRules.paCreate(__securityRuleObject, __folder, __position, includePosition=True) + else: + print("Please request new token and create new prismaAccess object.") + + def paSecurityRulesEdit(self, __securityRuleObject, __folder="Shared", __position="pre"): + if self.checkTokenStillValid(): + paSecurityRules = saseApi.saseApi(self.prismaAccessObject.securityRulesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paSecurityRules.paEdit(__securityRuleObject, __folder, __position, includePosition=True) + else: + print("Please request new token and create new prismaAccess object.") + + def paSecurityRulesDelete(self, __securityRuleObject, __folder="Shared", __position="pre"): + if self.checkTokenStillValid(): + paSecurityRules = saseApi.saseApi(self.prismaAccessObject.securityRulesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paSecurityRules.paDelete(__securityRuleObject, __folder, __position, includePosition=True) + else: + print("Please request new token and create new prismaAccess object.") + + def paAntiSpywareProfilesList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paAntiSpywareProfiles = saseApi.saseApi(self.prismaAccessObject.antiSpywareProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paAntiSpywareProfiles.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paAntiSpywareProfilesCreate(self, __antiSpywareProfilesObject, __folder="Shared"): + if self.checkTokenStillValid(): + paAntiSpywareProfiles = saseApi.saseApi(self.prismaAccessObject.antiSpywareProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paAntiSpywareProfiles.paCreate(__antiSpywareProfilesObject, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paAntiSpywareProfilesEdit(self, __antiSpywareProfilesObject, __folder="Shared"): + if self.checkTokenStillValid(): + paAntiSpywareProfiles = saseApi.saseApi(self.prismaAccessObject.antiSpywareProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paAntiSpywareProfiles.paEdit(__antiSpywareProfilesObject, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paAntiSpywareProfilesDelete(self, __antiSpywareProfilesObject, __folder="Shared"): + if self.checkTokenStillValid(): + paAntiSpywareProfiles = saseApi.saseApi(self.prismaAccessObject.antiSpywareProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paAntiSpywareProfiles.paDelete(__antiSpywareProfilesObject, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paAntiSpywareSignaturesList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paAntiSpywareSignatures = saseApi.saseApi(self.prismaAccessObject.antiSpywareSignaturesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paAntiSpywareSignatures.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paAntiSpywareSignaturesCreate(self, __antiSpywareSignaturesObject, __folder="Shared"): + if self.checkTokenStillValid(): + paAntiSpywareSignatures = saseApi.saseApi(self.prismaAccessObject.antiSpywareSignaturesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paAntiSpywareSignatures.paCreate(__antiSpywareSignaturesObject, __folder, name_key='threatname') + else: + print("Please request new token and create new prismaAccess object.") + + def paAntiSpywareSignaturesEdit(self, __antiSpywareSignaturesObject, __folder="Shared"): + if self.checkTokenStillValid(): + paAntiSpywareSignatures = saseApi.saseApi(self.prismaAccessObject.antiSpywareSignaturesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paAntiSpywareSignatures.paEdit(__antiSpywareSignaturesObject, __folder, name_key='threatname') + else: + print("Please request new token and create new prismaAccess object.") + + def paAntiSpywareSignaturesDelete(self, __antiSpywareSignaturesObject, __folder="Shared"): + if self.checkTokenStillValid(): + paAntiSpywareSignatures = saseApi.saseApi(self.prismaAccessObject.antiSpywareSignaturesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paAntiSpywareSignatures.paDelete(__antiSpywareSignaturesObject, __folder, name_key='threatname') + else: + print("Please request new token and create new prismaAccess object.") + + def paDnsSecurityProfilesList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paDnsSecurityProfiles = saseApi.saseApi(self.prismaAccessObject.dnsSecurityProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDnsSecurityProfiles.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDnsSecurityProfilesCreate(self, __dnsSecurityProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paDnsSecurityProfiles = saseApi.saseApi(self.prismaAccessObject.dnsSecurityProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDnsSecurityProfiles.paCreate(__dnsSecurityProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDnsSecurityProfilesEdit(self, __dnsSecurityProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paDnsSecurityProfiles = saseApi.saseApi(self.prismaAccessObject.dnsSecurityProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDnsSecurityProfiles.paEdit(__dnsSecurityProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDnsSecurityProfilesDelete(self, __dnsSecurityProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paDnsSecurityProfiles = saseApi.saseApi(self.prismaAccessObject.dnsSecurityProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDnsSecurityProfiles.paDelete(__dnsSecurityProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionExclusionsList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paDecryptionExclusions = saseApi.saseApi(self.prismaAccessObject.decryptionExclusionsUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionExclusions.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionExclusionsCreate(self, __decryptionExclusions, __folder="Shared"): + if self.checkTokenStillValid(): + paDecryptionExclusions = saseApi.saseApi(self.prismaAccessObject.decryptionExclusionsUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionExclusions.paCreate(__decryptionExclusions, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionExclusionsEdit(self, __decryptionExclusions, __folder="Shared"): + if self.checkTokenStillValid(): + paDecryptionExclusions = saseApi.saseApi(self.prismaAccessObject.decryptionExclusionsUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionExclusions.paEdit(__decryptionExclusions, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionExclusionsDelete(self, __decryptionExclusions, __folder="Shared"): + if self.checkTokenStillValid(): + paDecryptionExclusions = saseApi.saseApi(self.prismaAccessObject.decryptionExclusionsUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionExclusions.paDelete(__decryptionExclusions, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionProfilesList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paDecryptionProfiles = saseApi.saseApi(self.prismaAccessObject.decryptionProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionProfiles.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionProfilesCreate(self, __decryptionProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paDecryptionProfiles = saseApi.saseApi(self.prismaAccessObject.decryptionProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionProfiles.paCreate(__decryptionProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionProfilesEdit(self, __decryptionProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paDecryptionProfiles = saseApi.saseApi(self.prismaAccessObject.decryptionProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionProfiles.paEdit(__decryptionProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionProfilesDelete(self, __decryptionProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paDecryptionProfiles = saseApi.saseApi(self.prismaAccessObject.decryptionProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionProfiles.paDelete(__decryptionProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionRulesList(self, __folder="Shared", __position="pre"): + if self.checkTokenStillValid(): + paDecryptionRules = saseApi.saseApi(self.prismaAccessObject.decryptionRulesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionRules.paList(__folder, includePosition=True) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionRulesCreate(self, __decryptionRules, __folder="Shared", __position="pre"): + if self.checkTokenStillValid(): + paDecryptionRules = saseApi.saseApi(self.prismaAccessObject.decryptionRulesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionRules.paCreate(__decryptionRules, __folder, includePosition=True) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionRulesEdit(self, __decryptionRules, __folder="Shared", __position="pre"): + if self.checkTokenStillValid(): + paDecryptionRules = saseApi.saseApi(self.prismaAccessObject.decryptionRulesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionRules.paEdit(__decryptionRules, __folder, includePosition=True) + else: + print("Please request new token and create new prismaAccess object.") + + def paDecryptionRulesDelete(self, __decryptionRules, __folder="Shared", __position="pre"): + if self.checkTokenStillValid(): + paDecryptionRules = saseApi.saseApi(self.prismaAccessObject.decryptionRulesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paDecryptionRules.paDelete(__decryptionRules, __folder, includePosition=True) + else: + print("Please request new token and create new prismaAccess object.") + + def paFileBlockingProfilesList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paFileBlockingProfiles = saseApi.saseApi(self.prismaAccessObject.fileBlockingProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paFileBlockingProfiles.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paFileBlockingProfilesCreate(self, __fileBlockingProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paFileBlockingProfiles = saseApi.saseApi(self.prismaAccessObject.fileBlockingProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paFileBlockingProfiles.paCreate(__fileBlockingProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paFileBlockingProfilesEdit(self, __fileBlockingProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paFileBlockingProfiles = saseApi.saseApi(self.prismaAccessObject.fileBlockingProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paFileBlockingProfiles.paEdit(__fileBlockingProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paFileBlockingProfilesDelete(self, __fileBlockingProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paFileBlockingProfiles = saseApi.saseApi(self.prismaAccessObject.fileBlockingProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paFileBlockingProfiles.paDelete(__fileBlockingProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paHttpHeaderProfilesList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paHttpHeaderProfiles = saseApi.saseApi(self.prismaAccessObject.httpHeaderProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paHttpHeaderProfiles.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paHttpHeaderProfilesCreate(self, __httpHeaderProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paHttpHeaderProfiles = saseApi.saseApi(self.prismaAccessObject.httpHeaderProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paHttpHeaderProfiles.paCreate(__httpHeaderProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paHttpHeaderProfilesEdit(self, __httpHeaderProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paHttpHeaderProfiles = saseApi.saseApi(self.prismaAccessObject.httpHeaderProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paHttpHeaderProfiles.paEdit(__httpHeaderProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paHttpHeaderProfilesDelete(self, __httpHeaderProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paHttpHeaderProfiles = saseApi.saseApi(self.prismaAccessObject.httpHeaderProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paHttpHeaderProfiles.paDelete(__httpHeaderProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paProfileGroupsList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paProfileGroups = saseApi.saseApi(self.prismaAccessObject.profileGroupsUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paProfileGroups.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paProfileGroupsCreate(self, __profileGroups, __folder="Shared"): + if self.checkTokenStillValid(): + paProfileGroups = saseApi.saseApi(self.prismaAccessObject.profileGroupsUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paProfileGroups.paCreate(__profileGroups, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paProfileGroupsEdit(self, __profileGroups, __folder="Shared"): + if self.checkTokenStillValid(): + paProfileGroups = saseApi.saseApi(self.prismaAccessObject.profileGroupsUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paProfileGroups.paEdit(__profileGroups, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paProfileGroupsDelete(self, __profileGroups, __folder="Shared"): + if self.checkTokenStillValid(): + paProfileGroups = saseApi.saseApi(self.prismaAccessObject.profileGroupsUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paProfileGroups.paDelete(__profileGroups, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paUrlAccessProfilesList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paUrlAccessProfiles = saseApi.saseApi(self.prismaAccessObject.urlAccessProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paUrlAccessProfiles.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paUrlAccessProfilesCreate(self, __urlAccessProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paUrlAccessProfiles = saseApi.saseApi(self.prismaAccessObject.urlAccessProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paUrlAccessProfiles.paCreate(__urlAccessProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paUrlAccessProfilesEdit(self, __urlAccessProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paUrlAccessProfiles = saseApi.saseApi(self.prismaAccessObject.urlAccessProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paUrlAccessProfiles.paEdit(__urlAccessProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paUrlAccessProfilesDelete(self, __urlAccessProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paUrlAccessProfiles = saseApi.saseApi(self.prismaAccessObject.urlAccessProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paUrlAccessProfiles.paDelete(__urlAccessProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paVulnerabilityProtectProfilesList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paVulnerabilityProtectProfiles = saseApi.saseApi(self.prismaAccessObject.vulnerabilityProtectProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paVulnerabilityProtectProfiles.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paVulnerabilityProtectProfilesCreate(self, __vulnerabilityProtectProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paVulnerabilityProtectProfiles = saseApi.saseApi(self.prismaAccessObject.vulnerabilityProtectProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paVulnerabilityProtectProfiles.paCreate(__vulnerabilityProtectProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paVulnerabilityProtectProfilesEdit(self, __vulnerabilityProtectProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paVulnerabilityProtectProfiles = saseApi.saseApi(self.prismaAccessObject.vulnerabilityProtectProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paVulnerabilityProtectProfiles.paEdit(__vulnerabilityProtectProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paVulnerabilityProtectProfilesDelete(self, __vulnerabilityProtectProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paVulnerabilityProtectProfiles = saseApi.saseApi(self.prismaAccessObject.vulnerabilityProtectProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paVulnerabilityProtectProfiles.paDelete(__vulnerabilityProtectProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paVulnerabilityProtectSignaturesList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paVulnerabilityProtectSignatures = saseApi.saseApi(self.prismaAccessObject.vulnerabilityProtectSignaturesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paVulnerabilityProtectSignatures.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paVulnerabilityProtectSignaturesCreate(self, __vulnerabilityProtectSignatures, __folder="Shared"): + if self.checkTokenStillValid(): + paVulnerabilityProtectSignatures = saseApi.saseApi(self.prismaAccessObject.vulnerabilityProtectSignaturesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paVulnerabilityProtectSignatures.paCreate(__vulnerabilityProtectSignatures, __folder, name_key='threatname') + else: + print("Please request new token and create new prismaAccess object.") + + def paVulnerabilityProtectSignaturesEdit(self, __vulnerabilityProtectSignatures, __folder="Shared"): + if self.checkTokenStillValid(): + paVulnerabilityProtectSignatures = saseApi.saseApi(self.prismaAccessObject.vulnerabilityProtectSignaturesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paVulnerabilityProtectSignatures.paEdit(__vulnerabilityProtectSignatures, __folder, name_key='threatname') + else: + print("Please request new token and create new prismaAccess object.") + + def paVulnerabilityProtectSignaturesDelete(self, __vulnerabilityProtectSignatures, __folder="Shared"): + if self.checkTokenStillValid(): + paVulnerabilityProtectSignatures = saseApi.saseApi(self.prismaAccessObject.vulnerabilityProtectSignaturesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paVulnerabilityProtectSignatures.paDelete(__vulnerabilityProtectSignatures, __folder, name_key='threatname') + else: + print("Please request new token and create new prismaAccess object.") + + def paWildfireAntiVirusProfilesList(self, __folder="Shared"): + if self.checkTokenStillValid(): + paWildfireAntiVirusProfiles = saseApi.saseApi(self.prismaAccessObject.wildfireAntiVirusProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paWildfireAntiVirusProfiles.paList(__folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paWildfireAntiVirusProfilesCreate(self, __wildfireAntiVirusProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paWildfireAntiVirusProfiles = saseApi.saseApi(self.prismaAccessObject.wildfireAntiVirusProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paWildfireAntiVirusProfiles.paCreate(__wildfireAntiVirusProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paWildfireAntiVirusProfilesEdit(self, __wildfireAntiVirusProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paWildfireAntiVirusProfiles = saseApi.saseApi(self.prismaAccessObject.wildfireAntiVirusProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paWildfireAntiVirusProfiles.paEdit(__wildfireAntiVirusProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + + def paWildfireAntiVirusProfilesDelete(self, __wildfireAntiVirusProfiles, __folder="Shared"): + if self.checkTokenStillValid(): + paWildfireAntiVirusProfiles = saseApi.saseApi(self.prismaAccessObject.wildfireAntiVirusProfilesUri, self.prismaAccessObject.saseToken, self.prismaAccessObject.contentType, self.prismaAccessObject.saseAuthHeaders) + paWildfireAntiVirusProfiles.paDelete(__wildfireAntiVirusProfiles, __folder) + else: + print("Please request new token and create new prismaAccess object.") + def __init__(self, __prismaAccessObject): """securityServices class initialization""" - self.prismaAccessObject = __prismaAccessObject \ No newline at end of file + self.prismaAccessObject = __prismaAccessObject diff --git a/examples/securityServices/AntiSpywareProfiles.md b/examples/securityServices/AntiSpywareProfiles.md new file mode 100644 index 0000000..06dd91e --- /dev/null +++ b/examples/securityServices/AntiSpywareProfiles.md @@ -0,0 +1,78 @@ +# Examples on how to work with Anti-Spyware Profiles +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Anti-Spyware Profiles +To list all Anti-Spyware Profiles within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paAntiSpywareProfilesList() +``` + + +To list all Anti-Spyware Profiles within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paAntiSpywareProfilesList("Shared") +``` + + +## Create an Anti-Spyware Profile +To create an Anti-Spyware Profile in the _Shared_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +antiSpywareProfile = {"name":"best-practice2","folder":"Shared","description":"Best practice anti-spyware security profile","cloud_inline_analysis":True,"mica_engine_spyware_enabled":[{"name":"HTTP Command and Control detector","inline_policy_action":"reset-both"},{"name":"HTTP2 Command and Control detector","inline_policy_action":"reset-both"},{"name":"SSL Command and Control detector","inline_policy_action":"reset-both"},{"name":"Unknown-TCP Command and Control detector","inline_policy_action":"reset-both"},{"name":"Unknown-UDP Command and Control detector","inline_policy_action":"reset-both"}],"rules":[{"name":"simple-critical","action":{"reset_both":{}},"severity":["critical"],"category":"any","packet_capture":"single-packet"},{"name":"simple-high","action":{"reset_both":{}},"severity":["high"],"category":"any","packet_capture":"single-packet"},{"name":"simple-medium","action":{"reset_both":{}},"severity":["medium"],"category":"any","packet_capture":"single-packet"},{"name":"simple-informational","severity":["informational"],"category":"any","packet_capture":"single-packet"},{"name":"simple-low","severity":["low"],"category":"any","packet_capture":"single-packet"}]} +s.paAntiSpywareProfilesCreate(antiSpywareProfile) +``` + +This will create a Anti-Spyware Profile in the "Remote Networks" folder. + +```python +s = securityServices.securityServices(n) + +antiSpywareProfile = {"name":"best-practice2","folder":"Shared","description":"Best practice anti-spyware security profile","cloud_inline_analysis":True,"mica_engine_spyware_enabled":[{"name":"HTTP Command and Control detector","inline_policy_action":"reset-both"},{"name":"HTTP2 Command and Control detector","inline_policy_action":"reset-both"},{"name":"SSL Command and Control detector","inline_policy_action":"reset-both"},{"name":"Unknown-TCP Command and Control detector","inline_policy_action":"reset-both"},{"name":"Unknown-UDP Command and Control detector","inline_policy_action":"reset-both"}],"rules":[{"name":"simple-critical","action":{"reset_both":{}},"severity":["critical"],"category":"any","packet_capture":"single-packet"},{"name":"simple-high","action":{"reset_both":{}},"severity":["high"],"category":"any","packet_capture":"single-packet"},{"name":"simple-medium","action":{"reset_both":{}},"severity":["medium"],"category":"any","packet_capture":"single-packet"},{"name":"simple-informational","severity":["informational"],"category":"any","packet_capture":"single-packet"},{"name":"simple-low","severity":["low"],"category":"any","packet_capture":"single-packet"}]} +s.paAntiSpywareProfilesCreate(antiSpywareProfile, "Remote Networks") +``` + +## Edit an Anti-Spyware Profile +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Anti-Spyware Profile in the _Remote Networks_ folder. + +This will edit an existing Anti-Spyware Profile named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +antiSpywareProfile = {"name":"best-practice2","folder":"Shared","description":"Edit Best practice anti-spyware security profile","cloud_inline_analysis":True,"mica_engine_spyware_enabled":[{"name":"HTTP Command and Control detector","inline_policy_action":"reset-both"},{"name":"HTTP2 Command and Control detector","inline_policy_action":"reset-both"},{"name":"SSL Command and Control detector","inline_policy_action":"reset-both"},{"name":"Unknown-TCP Command and Control detector","inline_policy_action":"reset-both"},{"name":"Unknown-UDP Command and Control detector","inline_policy_action":"reset-both"}],"rules":[{"name":"simple-critical","action":{"reset_both":{}},"severity":["critical"],"category":"any","packet_capture":"single-packet"},{"name":"simple-high","action":{"reset_both":{}},"severity":["high"],"category":"any","packet_capture":"single-packet"},{"name":"simple-medium","action":{"reset_both":{}},"severity":["medium"],"category":"any","packet_capture":"single-packet"},{"name":"simple-informational","severity":["informational"],"category":"any","packet_capture":"single-packet"},{"name":"simple-low","severity":["low"],"category":"any","packet_capture":"single-packet"}]} +s.paAntiSpywareProfilesEdit(antiSpywareProfile, "Remote Networks") +``` + +## Delete an Anti-Spyware Profile +To delete an Anti-Spyware Profile in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +antiSpywareProfile = {"name":"best-practice2"} +s.paAntiSpywareProfilesDelete(antiSpywareProfile, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/AntiSpywareSignatures.md b/examples/securityServices/AntiSpywareSignatures.md new file mode 100644 index 0000000..f5cfcb6 --- /dev/null +++ b/examples/securityServices/AntiSpywareSignatures.md @@ -0,0 +1,78 @@ +# Examples on how to work with Anti-Spyware Signatures +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Anti-Spyware Signatures +To list all Anti-Spyware Signatures within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paAntiSpywareSignaturesList() +``` + + +To list all Anti-Spyware Signatures within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paAntiSpywareSignaturesList("Shared") +``` + + +## Create a Anti-Spyware Signatures +To create a Anti-Spyware Signatures in the _Shared_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +antiSpywareSignature = {"folder":"Shared","default_action":{"alert":{}},"threatname":"Example Signature","severity":"informational","direction":"both","cve":["CVE-12345"],"signature":{"standard":[{"name":"ExampleSig","scope":"protocol-data-unit","and_condition":[{"name":"And Condition 1","or_condition":[{"name":"Or Condition 1","operator":{"less_than":{"value":0,"context":"ssl-req-client-hello-missing-sni"}}}]}]}]},"threat_id":"15123"} +s.paAntiSpywareSignaturesCreate(antiSpywareSignature) +``` + +This will create a Anti-Spyware Signature in the "Shared" folder. + +```python +s = securityServices.securityServices(n) + +antiSpywareSignature = {"folder":"Shared","default_action":{"alert":{}},"threatname":"Example Signature","severity":"informational","direction":"both","cve":["CVE-12345"],"signature":{"standard":[{"name":"ExampleSig","scope":"protocol-data-unit","and_condition":[{"name":"And Condition 1","or_condition":[{"name":"Or Condition 1","operator":{"less_than":{"value":0,"context":"ssl-req-client-hello-missing-sni"}}}]}]}]},"threat_id":"15123"} +s.paAntiSpywareSignaturesCreate(antiSpywareSignature, "Remote Networks") +``` + +## Edit a Anti-Spyware Signature +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Anti-Spyware Signature in the _Remote Networks_ folder. + +This will edit an existing Anti-Spyware Signature named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +antiSpywareSignature = {"folder":"Shared","default_action":{"alert":{}},"threatname":"Example Signature","severity":"informational","direction":"both","cve":["CVE-12345"],"signature":{"standard":[{"name":"EditExampleSig","scope":"protocol-data-unit","and_condition":[{"name":"And Condition 1","or_condition":[{"name":"Or Condition 1","operator":{"less_than":{"value":0,"context":"ssl-req-client-hello-missing-sni"}}}]}]}]},"threat_id":"15123"} +s.paAntiSpywareSignaturesEdit(antiSpywareSignature, "Remote Networks") +``` + +## Delete a Anti-Spyware Signature +To delete a Anti-Spyware Signature in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +antiSpywareSignature = { "threatname": "Example Signature" } +s.paAntiSpywareSignaturesDelete(antiSpywareSignature, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/DecryptionExclusions.md b/examples/securityServices/DecryptionExclusions.md new file mode 100644 index 0000000..98e913e --- /dev/null +++ b/examples/securityServices/DecryptionExclusions.md @@ -0,0 +1,78 @@ +# Examples on how to work with Decryption Exclusions +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Decryption Exclusions +To list all Decryption Exclusions within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paDecryptionExclusionsList() +``` + + +To list all Decryption Exclusions within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paDecryptionExclusionsList("Shared") +``` + + +## Create a Decryption Exclusion +To create a Decryption Exclusion in the _Remote Networks_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +decryptionExclusions = {"name":"https://*.example.com","description":"Example exclusion"} +s.paDecryptionExclusionsCreate(decryptionExclusions) +``` + +This will create a Decryption Exclusion in the _"Remote Networks"_ folder. + +```python +s = securityServices.securityServices(n) + +decryptionExclusions = {"name":"https://*.example.com","description":"Example exclusion"} +s.paDecryptionExclusionsCreate(decryptionExclusions, "Remote Networks") +``` + +## Edit a Decryption Exclusion +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Decryption Exclusion in the _Remote Networks_ folder. + +This will edit an existing Decryption Exclusion named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +decryptionExclusions = {"name":"https://*.example.com","description":"Example exclusion"} +s.paDecryptionExclusionsEdit(decryptionExclusions, "Remote Networks") +``` + +## Delete a Decryption Exclusion +To delete a Decryption Exclusion in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +decryptionExclusions = { "name": "https://*.example.com" } +s.paDecryptionExclusionsDelete(decryptionExclusions, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/DecryptionProfiles.md b/examples/securityServices/DecryptionProfiles.md new file mode 100644 index 0000000..37ff947 --- /dev/null +++ b/examples/securityServices/DecryptionProfiles.md @@ -0,0 +1,78 @@ +# Examples on how to work with Decryption Profiles +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Decryption Profiles +To list all Decryption Profiles within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paDecryptionProfilesList() +``` + + +To list all Decryption Profiles within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paDecryptionProfilesList("Shared") +``` + + +## Create a Decryption Profile +To create a Decryption Profile in the _Remote Networks_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +decryptionProfiles = { "name": "best-practice2", "folder": "All", "snippet": "predefined-snippet", "ssl_no_proxy": { "block_expired_certificate": True, "block_untrusted_issuer": True }, "ssl_forward_proxy": { "block_expired_certificate": True, "block_untrusted_issuer": True, "block_unknown_cert": True, "restrict_cert_exts": True, "auto_include_altname": True, "block_unsupported_version": True, "block_unsupported_cipher": True, "block_client_cert": True }, "ssl_inbound_proxy": { "block_unsupported_version": True, "block_unsupported_cipher": True }, "ssl_protocol_settings": { "min_version": "tls1-2", "enc_algo_3des": False, "enc_algo_rc4": False, "auth_algo_sha1": False } } +s.paDecryptionProfilesCreate(decryptionProfiles) +``` + +This will create a Decryption Profile in the _"Remote Networks"_ folder. + +```python +s = securityServices.securityServices(n) + +decryptionProfiles = { "name": "best-practice2", "folder": "All", "snippet": "predefined-snippet", "ssl_no_proxy": { "block_expired_certificate": True, "block_untrusted_issuer": True }, "ssl_forward_proxy": { "block_expired_certificate": True, "block_untrusted_issuer": True, "block_unknown_cert": True, "restrict_cert_exts": True, "auto_include_altname": True, "block_unsupported_version": True, "block_unsupported_cipher": True, "block_client_cert": True }, "ssl_inbound_proxy": { "block_unsupported_version": True, "block_unsupported_cipher": True }, "ssl_protocol_settings": { "min_version": "tls1-2", "enc_algo_3des": False, "enc_algo_rc4": False, "auth_algo_sha1": False } } +s.paDecryptionProfilesCreate(decryptionProfiles, "Remote Networks") +``` + +## Edit a Decryption Profile +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Decryption Profile in the _Remote Networks_ folder. + +This will edit an existing Decryption Profile named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +decryptionProfiles = { "name": "best-practice2", "folder": "All", "snippet": "predefined-snippet", "ssl_no_proxy": { "block_expired_certificate": True, "block_untrusted_issuer": True }, "ssl_forward_proxy": { "block_expired_certificate": True, "block_untrusted_issuer": True, "block_unknown_cert": True, "restrict_cert_exts": True, "auto_include_altname": True, "block_unsupported_version": True, "block_unsupported_cipher": True, "block_client_cert": True }, "ssl_inbound_proxy": { "block_unsupported_version": True, "block_unsupported_cipher": True }, "ssl_protocol_settings": { "min_version": "tls1-2", "enc_algo_3des": False, "enc_algo_rc4": False, "auth_algo_sha1": False } } +s.paDecryptionProfilesEdit(decryptionProfiles, "Remote Networks") +``` + +## Delete a Decryption Profile +To delete a Decryption Profile in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +decryptionProfiles = { "name": "best-practice2" } +s.paDecryptionProfilesDelete(decryptionProfiles, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/DecryptionRules.md b/examples/securityServices/DecryptionRules.md new file mode 100644 index 0000000..5d48e17 --- /dev/null +++ b/examples/securityServices/DecryptionRules.md @@ -0,0 +1,78 @@ +# Examples on how to work with Decryption Rules +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Decryption Rules +To list all Decryption Rules within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paDecryptionRulesList() +``` + + +To list all Decryption Rules within a specific folder, e.g. _Shared_ (it defaults to _Shared_). You can also define the position (It defaults to _pre_). +```python +s = securityServices.securityServices(n) + +s.paDecryptionRulesList("Shared", "pre") +``` + + +## Create a Decryption Rule +To create a Decryption Rule in the _Remote Networks_ folder (it defaults to _Shared_). You can also define the position (It defaults to _pre_). + +```python +s = securityServices.securityServices(n) + +decryptionRule = {"name":"Exempt Healthcare and Financial","folder":"Shared","position":"pre","source_hip":["any"],"action":"no-decrypt","profile":"best-practice","from":["trust"],"to":["untrust"],"source":["any"],"destination":["any"],"source_user":["any"],"category":["financial-services","health-and-medicine"],"service":["any"],"log_setting":"Cortex Data Lake","type":{"ssl_forward_proxy":{}}} +s.paDecryptionRulesCreate(decryptionRule) +``` + +This will create a Decryption Rule in the "Remote Networks" folder. + +```python +s = securityServices.securityServices(n) + +decryptionRule = {"name":"Exempt Healthcare and Financial","folder":"Shared","position":"pre","source_hip":["any"],"action":"no-decrypt","profile":"best-practice","from":["trust"],"to":["untrust"],"source":["any"],"destination":["any"],"source_user":["any"],"category":["financial-services","health-and-medicine"],"service":["any"],"log_setting":"Cortex Data Lake","type":{"ssl_forward_proxy":{}}} +s.paDecryptionRulesCreate(decryptionRule, "Remote Networks") +``` + +## Edit a Decryption Rule +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Decryption Rule in the _Remote Networks_ folder. + +This will edit an existing Decryption Rule named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +decryptionRule = {"name":"Exempt Healthcare and Financial","folder":"Shared","position":"pre","source_hip":["any"],"action":"no-decrypt","profile":"best-practice","from":["trust"],"to":["untrust"],"source":["any"],"destination":["any"],"source_user":["any"],"category":["financial-services","health-and-medicine"],"service":["any"],"log_setting":"Cortex Data Lake","type":{"ssl_forward_proxy":{}}} +s.paDecryptionRulesEdit(decryptionRule, "Remote Networks") +``` + +## Delete a Decryption Rule +To delete a Decryption Rule in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +decryptionRule = { "name": "Exempt Healthcare and Financial" } +s.paDecryptionRulesDelete(decryptionRule, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/DnsSecurityProfiles.md b/examples/securityServices/DnsSecurityProfiles.md new file mode 100644 index 0000000..01edc05 --- /dev/null +++ b/examples/securityServices/DnsSecurityProfiles.md @@ -0,0 +1,78 @@ +# Examples on how to work with Dns Security Profiles +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Dns Security Profiles +To list all Dns Security Profiles within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paDnsSecurityProfilesList() +``` + + +To list all Dns Security Profiles within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paDnsSecurityProfilesList("Shared") +``` + + +## Create a Dns Security Profile +To create a Dns Security Profile in the _Remote Networks_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +dnsSecurityProfiles = {"name":"best-practice2","folder":"Shared","botnet_domains":{"dns_security_categories":[{"name":"pan-dns-sec-grayware","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-recent","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-parked","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-proxy","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-cc","log_level":"default","action":"sinkhole","packet_capture":"single-packet"},{"name":"pan-dns-sec-ddns","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-phishing","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-malware","log_level":"default","action":"sinkhole","packet_capture":"disable"}],"lists":[{"name":"default-paloalto-dns","packet_capture":"disable","action":{"sinkhole":{}}}],"sinkhole":{"ipv4_address":"pan-sinkhole-default-ip","ipv6_address":"::1"}},"description":"Best practice dns security profile"} +s.paDnsSecurityProfilesCreate(dnsSecurityProfiles) +``` + +This will create a Dns Security Profile in the _"Remote Networks"_ folder. + +```python +s = securityServices.securityServices(n) + +dnsSecurityProfiles = {"name":"best-practice2","folder":"Shared","botnet_domains":{"dns_security_categories":[{"name":"pan-dns-sec-grayware","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-recent","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-parked","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-proxy","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-cc","log_level":"default","action":"sinkhole","packet_capture":"single-packet"},{"name":"pan-dns-sec-ddns","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-phishing","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-malware","log_level":"default","action":"sinkhole","packet_capture":"disable"}],"lists":[{"name":"default-paloalto-dns","packet_capture":"disable","action":{"sinkhole":{}}}],"sinkhole":{"ipv4_address":"pan-sinkhole-default-ip","ipv6_address":"::1"}},"description":"Best practice dns security profile"} +s.paDnsSecurityProfilesCreate(dnsSecurityProfiles, "Remote Networks") +``` + +## Edit a Dns Security Profile +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Dns Security Profile in the _Remote Networks_ folder. + +This will edit an existing Dns Security Profile named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +dnsSecurityProfiles = {"name":"best-practice2","folder":"Shared","botnet_domains":{"dns_security_categories":[{"name":"pan-dns-sec-grayware","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-recent","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-parked","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-proxy","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-cc","log_level":"default","action":"sinkhole","packet_capture":"single-packet"},{"name":"pan-dns-sec-ddns","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-phishing","log_level":"default","action":"sinkhole","packet_capture":"disable"},{"name":"pan-dns-sec-malware","log_level":"default","action":"sinkhole","packet_capture":"disable"}],"lists":[{"name":"default-paloalto-dns","packet_capture":"disable","action":{"sinkhole":{}}}],"sinkhole":{"ipv4_address":"pan-sinkhole-default-ip","ipv6_address":"::1"}},"description":"Best practice dns security profile"} +s.paDnsSecurityProfilesEdit(dnsSecurityProfiles, "Remote Networks") +``` + +## Delete a Dns Security Profile +To delete a Dns Security Profile in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +dnsSecurityProfiles = { "name": "best-practice2" } +s.paDnsSecurityProfilesDelete(dnsSecurityProfiles, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/FileBlockingProfiles.md b/examples/securityServices/FileBlockingProfiles.md new file mode 100644 index 0000000..ab16a0f --- /dev/null +++ b/examples/securityServices/FileBlockingProfiles.md @@ -0,0 +1,78 @@ +# Examples on how to work with File Blocking Profiles +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all File Blocking Profiles +To list all File Blocking Profiles within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paFileBlockingProfilesList() +``` + + +To list all File Blocking Profiles within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paFileBlockingProfilesList("Shared") +``` + + +## Create a File Blocking Profile +To create a File Blocking Profile in the _Remote Networks_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +fileBlockingProfiles = {"name":"best-practice2","folder":"Shared","rules":[{"name":"Block all risky file types","application":["any"],"file_type":["7z","ace","arj","bas","bat","bzip2","cab","chm","class","cmd","com","cpl","deflate64-zip","dll","dmg","elf","encrypted-7z","encrypted-rar","encrypted-zip","exe","flash","gadget","hlp","hta","ico","inf","iso","jar","job","jse","lib","lnk","lzh","macapp","mach-o","microsoft-shell","mpkg","msc","msi","Multi-Level-Encoding","PE","pif","pkg","pl","powershell","prg","py","rar","reg","scf","scr","sh","shk","split-cab","split-rar","sys","tbz2","torrent","vb","vbe","vbs","vmdk","vxd","wsf","wsh"],"direction":"both","action":"block"},{"name":"Continue prompt encrypted files","application":["any"],"file_type":["encrypted-rar","encrypted-zip"],"direction":"both","action":"block"},{"name":"Log all other file types","application":["any"],"file_type":["any"],"direction":"both","action":"alert"}],"description":"Best practice file blocking security profile"} +s.paFileBlockingProfilesCreate(fileBlockingProfiles) +``` + +This will create a File Blocking Profile in the _"Remote Networks"_ folder. + +```python +s = securityServices.securityServices(n) + +fileBlockingProfiles = {"name":"best-practice2","folder":"Shared","rules":[{"name":"Block all risky file types","application":["any"],"file_type":["7z","ace","arj","bas","bat","bzip2","cab","chm","class","cmd","com","cpl","deflate64-zip","dll","dmg","elf","encrypted-7z","encrypted-rar","encrypted-zip","exe","flash","gadget","hlp","hta","ico","inf","iso","jar","job","jse","lib","lnk","lzh","macapp","mach-o","microsoft-shell","mpkg","msc","msi","Multi-Level-Encoding","PE","pif","pkg","pl","powershell","prg","py","rar","reg","scf","scr","sh","shk","split-cab","split-rar","sys","tbz2","torrent","vb","vbe","vbs","vmdk","vxd","wsf","wsh"],"direction":"both","action":"block"},{"name":"Continue prompt encrypted files","application":["any"],"file_type":["encrypted-rar","encrypted-zip"],"direction":"both","action":"block"},{"name":"Log all other file types","application":["any"],"file_type":["any"],"direction":"both","action":"alert"}],"description":"Best practice file blocking security profile"} +s.paFileBlockingProfilesCreate(fileBlockingProfiles, "Remote Networks") +``` + +## Edit a File Blocking Profile +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing File Blocking Profile in the _Remote Networks_ folder. + +This will edit an existing File Blocking Profile named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +fileBlockingProfiles = {"name":"best-practice2","folder":"Shared","rules":[{"name":"Block all risky file types","application":["any"],"file_type":["7z","ace","arj","bas","bat","bzip2","cab","chm","class","cmd","com","cpl","deflate64-zip","dll","dmg","elf","encrypted-7z","encrypted-rar","encrypted-zip","exe","flash","gadget","hlp","hta","ico","inf","iso","jar","job","jse","lib","lnk","lzh","macapp","mach-o","microsoft-shell","mpkg","msc","msi","Multi-Level-Encoding","PE","pif","pkg","pl","powershell","prg","py","rar","reg","scf","scr","sh","shk","split-cab","split-rar","sys","tbz2","torrent","vb","vbe","vbs","vmdk","vxd","wsf","wsh"],"direction":"both","action":"block"},{"name":"Continue prompt encrypted files","application":["any"],"file_type":["encrypted-rar","encrypted-zip"],"direction":"both","action":"block"},{"name":"Log all other file types","application":["any"],"file_type":["any"],"direction":"both","action":"alert"}],"description":"Best practice file blocking security profile"} +s.paFileBlockingProfilesEdit(fileBlockingProfiles, "Remote Networks") +``` + +## Delete a File Blocking Profile +To delete a File Blocking Profile in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +fileBlockingProfiles = { "name": "best-practice2" } +s.paFileBlockingProfilesDelete(fileBlockingProfiles, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/HttpHeaderProfiles.md b/examples/securityServices/HttpHeaderProfiles.md new file mode 100644 index 0000000..1d7e447 --- /dev/null +++ b/examples/securityServices/HttpHeaderProfiles.md @@ -0,0 +1,78 @@ +# Examples on how to work with Http Header Profiles +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Http Header Profiles +To list all Http Header Profiles within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paHttpHeaderProfilesList() +``` + + +To list all Http Header Profiles within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paHttpHeaderProfilesList("Shared") +``` + + +## Create a Http Header Profile +To create a Http Header Profile in the _Remote Networks_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +httpHeaderProfiles = {"name":"ExampleProfile","folder":"Shared","http_header_insertion":[{"name":"Example","type":[{"name":"Dropbox Network Control","headers":[{"name":"example123","header":"X-Dropbox-allowed-Team-Ids","value":"test123","log":True}],"domains":["*.dropbox.com"]}]}]} +s.paHttpHeaderProfilesCreate(httpHeaderProfiles) +``` + +This will create a Http Header Profile in the _"Remote Networks"_ folder. + +```python +s = securityServices.securityServices(n) + +httpHeaderProfiles = {"name":"ExampleProfile","folder":"Shared","http_header_insertion":[{"name":"Example","type":[{"name":"Dropbox Network Control","headers":[{"name":"example123","header":"X-Dropbox-allowed-Team-Ids","value":"test123","log":True}],"domains":["*.dropbox.com"]}]}]} +s.paHttpHeaderProfilesCreate(httpHeaderProfiles, "Remote Networks") +``` + +## Edit a Http Header Profile +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Http Header Profile in the _Remote Networks_ folder. + +This will edit an existing Http Header Profile named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +httpHeaderProfiles = {"name":"ExampleProfile","folder":"Shared","http_header_insertion":[{"name":"Example","type":[{"name":"Dropbox Network Control","headers":[{"name":"example123","header":"X-Dropbox-allowed-Team-Ids","value":"test123","log":True}],"domains":["*.dropbox.com"]}]}]} +s.paHttpHeaderProfilesEdit(httpHeaderProfiles, "Remote Networks") +``` + +## Delete a Http Header Profile +To delete a Http Header Profile in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +httpHeaderProfiles = { "name": "ExampleProfile" } +s.paHttpHeaderProfilesDelete(httpHeaderProfiles, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/ProfileGroups.md b/examples/securityServices/ProfileGroups.md new file mode 100644 index 0000000..a40dfc2 --- /dev/null +++ b/examples/securityServices/ProfileGroups.md @@ -0,0 +1,78 @@ +# Examples on how to work with Profile Groups +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Profile Groups +To list all Profile Groups within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paProfileGroupsList() +``` + + +To list all Profile Groups within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paProfileGroupsList("Shared") +``` + + +## Create a Profile Group +To create a Profile Group in the _Remote Networks_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +profileGroup = {"name":"best-practice2","folder":"Shared","virus_and_wildfire_analysis":["best-practice2"],"spyware":["best-practice2"],"dns_security":["best-practice2"],"vulnerability":["best-practice2"],"url_filtering":["best-practice2"],"file_blocking":["best-practice2"]} +s.paProfileGroupsCreate(profileGroup) +``` + +This will create a Profile Group in the _"Remote Networks"_ folder. + +```python +s = securityServices.securityServices(n) + +profileGroup = {"name":"best-practice2","folder":"Shared","virus_and_wildfire_analysis":["best-practice2"],"spyware":["best-practice2"],"dns_security":["best-practice2"],"vulnerability":["best-practice2"],"url_filtering":["best-practice2"],"file_blocking":["best-practice2"]} +s.paProfileGroupsCreate(profileGroup, "Remote Networks") +``` + +## Edit a Profile Group +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Profile Group in the _Remote Networks_ folder. + +This will edit an existing Profile Group named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +profileGroup = {"name":"best-practice2","folder":"Shared","virus_and_wildfire_analysis":["best-practice2"],"spyware":["best-practice2"],"dns_security":["best-practice2"],"vulnerability":["best-practice2"],"url_filtering":["best-practice2"],"file_blocking":["best-practice2"]} +s.paProfileGroupsEdit(profileGroup, "Remote Networks") +``` + +## Delete a Profile Group +To delete a Profile Group in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +profileGroup = { "name": "practice2" } +s.paProfileGroupsDelete(profileGroup, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/SecurityRules.md b/examples/securityServices/SecurityRules.md new file mode 100644 index 0000000..77b8046 --- /dev/null +++ b/examples/securityServices/SecurityRules.md @@ -0,0 +1,78 @@ +# Examples on how to work with Security Rules +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Security Rules +To list all security rules within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paSecurityRulesList() +``` + + +To list all security rules within a specific folder, e.g. _Shared_ (it defaults to _Shared_). You can also define the position (It defaults to _pre_). +```python +s = securityServices.securityServices(n) + +s.paSecurityRulesList("Shared", "pre") +``` + + +## Create a Security Rule +To create a security rule in the _Remote Networks_ folder (it defaults to _Shared_). You can also define the position (It defaults to _pre_). + +```python +s = securityServices.securityServices(n) + +securityRule = {"name":"Sample Policy","folder":"Shared","position":"pre","action":"allow","application":["ping"],"category":["any"],"description":"Description of Sample Policy","destination":["any"],"destination_hip":["any"],"disabled":False,"from":["trust"],"log_setting":"Cortex Data Lake","negate_destination":False,"negate_source":False,"profile_setting":{"group":["best-practice"]},"service":["any"],"source":["any"],"source_hip":["any"],"source_user":["any"],"tag":[],"to":["untrust"]} +s.paSecurityRulesCreate(securityRule) +``` + +This will create a security rule in the "Remote Networks" folder. + +```python +s = securityServices.securityServices(n) + +securityRule = {"name":"Sample Policy","folder":"Shared","position":"pre","action":"allow","application":["ping"],"category":["any"],"description":"Description of Sample Policy","destination":["any"],"destination_hip":["any"],"disabled":False,"from":["trust"],"log_setting":"Cortex Data Lake","negate_destination":False,"negate_source":False,"profile_setting":{"group":["best-practice"]},"service":["any"],"source":["any"],"source_hip":["any"],"source_user":["any"],"tag":[],"to":["untrust"]} +s.paSecurityRulesCreate(securityRule, "Remote Networks") +``` + +## Edit a Security Rule +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing security rule in the _Remote Networks_ folder. + +This will edit an existing security rule named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +securityRule = {"name":"Sample Policy","folder":"Shared","position":"pre","action":"allow","application":["ping"],"category":["any"],"description":"Edited Description of Sample Policy","destination":["any"],"destination_hip":["any"],"disabled":False,"from":["trust"],"log_setting":"Cortex Data Lake","negate_destination":False,"negate_source":False,"profile_setting":{"group":["best-practice"]},"service":["any"],"source":["any"],"source_hip":["any"],"source_user":["any"],"tag":[],"to":["untrust"]} +s.paSecurityRulesEdit(securityRule, "Remote Networks") +``` + +## Delete a Security Rule +To delete a security rule in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +securityRule = { "name": "Sample Policy" } +s.paSecurityRulesDelete(securityRule, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/UrlAccessProfiles.md b/examples/securityServices/UrlAccessProfiles.md new file mode 100644 index 0000000..de01166 --- /dev/null +++ b/examples/securityServices/UrlAccessProfiles.md @@ -0,0 +1,78 @@ +# Examples on how to work with Url Access Profiles +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Url Access Profiles +To list all Url Access Profiles within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paUrlAccessProfilesList() +``` + + +To list all Url Access Profiles within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paUrlAccessProfilesList("Shared") +``` + + +## Create a Url Access Profile +To create a Url Access Profile in the _Remote Networks_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +urlAccessProfiles = {"name":"best-practice2","folder":"Shared","local_inline_cat":True,"credential_enforcement":{"mode":{"ip_user":{}},"log_severity":"medium","alert":["abortion","alcohol-and-tobacco","auctions","business-and-economy","computer-and-internet-info","content-delivery-networks","cryptocurrency","dating","educational-institutions","entertainment-and-arts","financial-services","games","government","health-and-medicine","high-risk","home-and-garden","hunting-and-fishing","internet-communications-and-telephony","internet-portals","job-search","legal","low-risk","medium-risk","military","motor-vehicles","music","news","not-resolved","nudity","online-storage-and-backup","personal-sites-and-blogs","philosophy-and-political-advocacy","private-ip-addresses","real-estate","recreation-and-hobbies","reference-and-research","religion","search-engines","sex-education","shareware-and-freeware","shopping","social-networking","society","sports","stock-advice-and-tools","streaming-media","swimsuits-and-intimate-apparel","training-and-tools","translation","travel","web-advertisements","web-based-email","web-hosting"],"block":["abused-drugs","adult","command-and-control","copyright-infringement","dynamic-dns","extremism","gambling","grayware","hacking","insufficient-content","malware","newly-registered-domain","parked","peer-to-peer","phishing","proxy-avoidance-and-anonymizers","ransomware","questionable","unknown","weapons"]},"alert":["abortion","alcohol-and-tobacco","auctions","business-and-economy","computer-and-internet-info","content-delivery-networks","cryptocurrency","dating","educational-institutions","entertainment-and-arts","financial-services","games","government","health-and-medicine","home-and-garden","hunting-and-fishing","internet-communications-and-telephony","internet-portals","job-search","legal","low-risk","medium-risk","military","motor-vehicles","music","news","not-resolved","nudity","online-storage-and-backup","personal-sites-and-blogs","philosophy-and-political-advocacy","private-ip-addresses","real-estate","recreation-and-hobbies","reference-and-research","religion","search-engines","sex-education","shareware-and-freeware","shopping","social-networking","society","sports","stock-advice-and-tools","streaming-media","swimsuits-and-intimate-apparel","training-and-tools","translation","travel","web-advertisements","web-based-email","web-hosting"],"block":["abused-drugs","adult","command-and-control","copyright-infringement","dynamic-dns","extremism","gambling","grayware","hacking","high-risk","insufficient-content","malware","newly-registered-domain","parked","peer-to-peer","phishing","proxy-avoidance-and-anonymizers","ransomware","questionable","unknown","weapons"]} +s.paUrlAccessProfilesCreate(urlAccessProfiles) +``` + +This will create a Url Access Profile in the _"Remote Networks"_ folder. + +```python +s = securityServices.securityServices(n) + +urlAccessProfiles = {"name":"best-practice2","folder":"Shared","local_inline_cat":True,"credential_enforcement":{"mode":{"ip_user":{}},"log_severity":"medium","alert":["abortion","alcohol-and-tobacco","auctions","business-and-economy","computer-and-internet-info","content-delivery-networks","cryptocurrency","dating","educational-institutions","entertainment-and-arts","financial-services","games","government","health-and-medicine","high-risk","home-and-garden","hunting-and-fishing","internet-communications-and-telephony","internet-portals","job-search","legal","low-risk","medium-risk","military","motor-vehicles","music","news","not-resolved","nudity","online-storage-and-backup","personal-sites-and-blogs","philosophy-and-political-advocacy","private-ip-addresses","real-estate","recreation-and-hobbies","reference-and-research","religion","search-engines","sex-education","shareware-and-freeware","shopping","social-networking","society","sports","stock-advice-and-tools","streaming-media","swimsuits-and-intimate-apparel","training-and-tools","translation","travel","web-advertisements","web-based-email","web-hosting"],"block":["abused-drugs","adult","command-and-control","copyright-infringement","dynamic-dns","extremism","gambling","grayware","hacking","insufficient-content","malware","newly-registered-domain","parked","peer-to-peer","phishing","proxy-avoidance-and-anonymizers","ransomware","questionable","unknown","weapons"]},"alert":["abortion","alcohol-and-tobacco","auctions","business-and-economy","computer-and-internet-info","content-delivery-networks","cryptocurrency","dating","educational-institutions","entertainment-and-arts","financial-services","games","government","health-and-medicine","home-and-garden","hunting-and-fishing","internet-communications-and-telephony","internet-portals","job-search","legal","low-risk","medium-risk","military","motor-vehicles","music","news","not-resolved","nudity","online-storage-and-backup","personal-sites-and-blogs","philosophy-and-political-advocacy","private-ip-addresses","real-estate","recreation-and-hobbies","reference-and-research","religion","search-engines","sex-education","shareware-and-freeware","shopping","social-networking","society","sports","stock-advice-and-tools","streaming-media","swimsuits-and-intimate-apparel","training-and-tools","translation","travel","web-advertisements","web-based-email","web-hosting"],"block":["abused-drugs","adult","command-and-control","copyright-infringement","dynamic-dns","extremism","gambling","grayware","hacking","high-risk","insufficient-content","malware","newly-registered-domain","parked","peer-to-peer","phishing","proxy-avoidance-and-anonymizers","ransomware","questionable","unknown","weapons"]} +s.paUrlAccessProfilesCreate(urlAccessProfiles, "Remote Networks") +``` + +## Edit a Url Access Profile +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Url Access Profile in the _Remote Networks_ folder. + +This will edit an existing Url Access Profile named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +urlAccessProfiles = {"name":"best-practice2","folder":"Shared","local_inline_cat":True,"credential_enforcement":{"mode":{"ip_user":{}},"log_severity":"medium","alert":["abortion","alcohol-and-tobacco","auctions","business-and-economy","computer-and-internet-info","content-delivery-networks","cryptocurrency","dating","educational-institutions","entertainment-and-arts","financial-services","games","government","health-and-medicine","high-risk","home-and-garden","hunting-and-fishing","internet-communications-and-telephony","internet-portals","job-search","legal","low-risk","medium-risk","military","motor-vehicles","music","news","not-resolved","nudity","online-storage-and-backup","personal-sites-and-blogs","philosophy-and-political-advocacy","private-ip-addresses","real-estate","recreation-and-hobbies","reference-and-research","religion","search-engines","sex-education","shareware-and-freeware","shopping","social-networking","society","sports","stock-advice-and-tools","streaming-media","swimsuits-and-intimate-apparel","training-and-tools","translation","travel","web-advertisements","web-based-email","web-hosting"],"block":["abused-drugs","adult","command-and-control","copyright-infringement","dynamic-dns","extremism","gambling","grayware","hacking","insufficient-content","malware","newly-registered-domain","parked","peer-to-peer","phishing","proxy-avoidance-and-anonymizers","ransomware","questionable","unknown","weapons"]},"alert":["abortion","alcohol-and-tobacco","auctions","business-and-economy","computer-and-internet-info","content-delivery-networks","cryptocurrency","dating","educational-institutions","entertainment-and-arts","financial-services","games","government","health-and-medicine","home-and-garden","hunting-and-fishing","internet-communications-and-telephony","internet-portals","job-search","legal","low-risk","medium-risk","military","motor-vehicles","music","news","not-resolved","nudity","online-storage-and-backup","personal-sites-and-blogs","philosophy-and-political-advocacy","private-ip-addresses","real-estate","recreation-and-hobbies","reference-and-research","religion","search-engines","sex-education","shareware-and-freeware","shopping","social-networking","society","sports","stock-advice-and-tools","streaming-media","swimsuits-and-intimate-apparel","training-and-tools","translation","travel","web-advertisements","web-based-email","web-hosting"],"block":["abused-drugs","adult","command-and-control","copyright-infringement","dynamic-dns","extremism","gambling","grayware","hacking","high-risk","insufficient-content","malware","newly-registered-domain","parked","peer-to-peer","phishing","proxy-avoidance-and-anonymizers","ransomware","questionable","unknown","weapons"]} +s.paUrlAccessProfilesEdit(urlAccessProfiles, "Remote Networks") +``` + +## Delete a Url Access Profile +To delete a Url Access Profile in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +urlAccessProfiles = { "name": "best-practice2" } +s.paUrlAccessProfilesDelete(urlAccessProfiles, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/VulnerabilityProtectProfiles.md b/examples/securityServices/VulnerabilityProtectProfiles.md new file mode 100644 index 0000000..93f7d5d --- /dev/null +++ b/examples/securityServices/VulnerabilityProtectProfiles.md @@ -0,0 +1,78 @@ +# Examples on how to work with Vulnerability Protect Profiles +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Vulnerability Protect Profiles +To list all Vulnerability Protect Profiles within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paVulnerabilityProtectProfilesList() +``` + + +To list all Vulnerability Protect Profiles within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paVulnerabilityProtectProfilesList("Shared") +``` + + +## Create a Vulnerability Protect Profile +To create a Vulnerability Protect Profile in the _Remote Networks_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +vulnerabilityProtectProfiles = {"name":"best-practice2","folder":"Shared","description":"Best practice vulnerability protection security profile","rules":[{"name":"simple-client-critical","action":{"reset_both":{}},"vendor_id":["any"],"severity":["critical"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-high","action":{"reset_both":{}},"vendor_id":["any"],"severity":["high"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-medium","action":{"reset_both":{}},"vendor_id":["any"],"severity":["medium"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-informational","vendor_id":["any"],"severity":["informational"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-low","vendor_id":["any"],"severity":["low"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-server-critical","action":{"reset_both":{}},"vendor_id":["any"],"severity":["critical"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"},{"name":"simple-server-high","action":{"reset_both":{}},"vendor_id":["any"],"severity":["high"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"},{"name":"simple-server-medium","action":{"reset_both":{}},"vendor_id":["any"],"severity":["medium"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"},{"name":"simple-server-informational","vendor_id":["any"],"severity":["informational"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"disable"},{"name":"simple-server-low","vendor_id":["any"],"severity":["low"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"}]} +s.paVulnerabilityProtectProfilesCreate(vulnerabilityProtectProfiles) +``` + +This will create a Vulnerability Protect Profile in the _"Remote Networks"_ folder. + +```python +s = securityServices.securityServices(n) + +vulnerabilityProtectProfiles = {"name":"best-practice2","folder":"Shared","description":"Best practice vulnerability protection security profile","rules":[{"name":"simple-client-critical","action":{"reset_both":{}},"vendor_id":["any"],"severity":["critical"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-high","action":{"reset_both":{}},"vendor_id":["any"],"severity":["high"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-medium","action":{"reset_both":{}},"vendor_id":["any"],"severity":["medium"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-informational","vendor_id":["any"],"severity":["informational"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-low","vendor_id":["any"],"severity":["low"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-server-critical","action":{"reset_both":{}},"vendor_id":["any"],"severity":["critical"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"},{"name":"simple-server-high","action":{"reset_both":{}},"vendor_id":["any"],"severity":["high"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"},{"name":"simple-server-medium","action":{"reset_both":{}},"vendor_id":["any"],"severity":["medium"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"},{"name":"simple-server-informational","vendor_id":["any"],"severity":["informational"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"disable"},{"name":"simple-server-low","vendor_id":["any"],"severity":["low"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"}]} +s.paVulnerabilityProtectProfilesCreate(vulnerabilityProtectProfiles, "Remote Networks") +``` + +## Edit a Vulnerability Protect Profile +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Vulnerability Protect Profile in the _Remote Networks_ folder. + +This will edit an existing Vulnerability Protect Profile named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +vulnerabilityProtectProfiles = {"name":"best-practice2","folder":"Shared","description":"Best practice vulnerability protection security profile","rules":[{"name":"simple-client-critical","action":{"reset_both":{}},"vendor_id":["any"],"severity":["critical"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-high","action":{"reset_both":{}},"vendor_id":["any"],"severity":["high"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-medium","action":{"reset_both":{}},"vendor_id":["any"],"severity":["medium"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-informational","vendor_id":["any"],"severity":["informational"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-client-low","vendor_id":["any"],"severity":["low"],"cve":["any"],"threat_name":"any","host":"client","category":"any","packet_capture":"single-packet"},{"name":"simple-server-critical","action":{"reset_both":{}},"vendor_id":["any"],"severity":["critical"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"},{"name":"simple-server-high","action":{"reset_both":{}},"vendor_id":["any"],"severity":["high"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"},{"name":"simple-server-medium","action":{"reset_both":{}},"vendor_id":["any"],"severity":["medium"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"},{"name":"simple-server-informational","vendor_id":["any"],"severity":["informational"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"disable"},{"name":"simple-server-low","vendor_id":["any"],"severity":["low"],"cve":["any"],"threat_name":"any","host":"server","category":"any","packet_capture":"single-packet"}]} +s.paVulnerabilityProtectProfilesEdit(vulnerabilityProtectProfiles, "Remote Networks") +``` + +## Delete a Vulnerability Protect Profile +To delete a Vulnerability Protect Profile in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +vulnerabilityProtectProfiles = { "name": "best-practice2" } +s.paVulnerabilityProtectProfilesDelete(vulnerabilityProtectProfiles, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/VulnerabilityProtectSignatures.md b/examples/securityServices/VulnerabilityProtectSignatures.md new file mode 100644 index 0000000..0e0c4ea --- /dev/null +++ b/examples/securityServices/VulnerabilityProtectSignatures.md @@ -0,0 +1,78 @@ +# Examples on how to work with Vulnerability Protect Signatures +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Vulnerability Protect Signatures +To list all Vulnerability Protect Signatures within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paVulnerabilityProtectSignatureList() +``` + + +To list all Vulnerability Protect Signatures within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paVulnerabilityProtectSignatureList("Shared") +``` + + +## Create a Vulnerability Protect Signatures +To create a Vulnerability Protect Signatures in the _Shared_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +vulnerabilityProtectSignature = {"folder":"Shared","default_action":{"alert":{}},"direction":"both","severity":"informational","affected_host":{"client":True},"cve":["CVE-12222"],"threatname":"Example","signature":{"standard":[{"name":"ExampleSig","scope":"protocol-data-unit","and_condition":[{"name":"And Condition 1","or_condition":[{"name":"Or Condition 1","operator":{"less_than":{"context":"cip-ethernet-ip-req-instance-id","value":0}}}]}]}]},"threat_id":"41012"} +s.paVulnerabilityProtectSignatureCreate(vulnerabilityProtectSignature) +``` + +This will create a Vulnerability Protect Signature in the "Shared" folder. + +```python +s = securityServices.securityServices(n) + +vulnerabilityProtectSignature = {"folder":"Shared","default_action":{"alert":{}},"direction":"both","severity":"informational","affected_host":{"client":True},"cve":["CVE-12222"],"threatname":"Example","signature":{"standard":[{"name":"ExampleSig","scope":"protocol-data-unit","and_condition":[{"name":"And Condition 1","or_condition":[{"name":"Or Condition 1","operator":{"less_than":{"context":"cip-ethernet-ip-req-instance-id","value":0}}}]}]}]},"threat_id":"41012"} +s.paVulnerabilityProtectSignatureCreate(vulnerabilityProtectSignature, "Remote Networks") +``` + +## Edit a Vulnerability Protect Signature +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Vulnerability Protect Signature in the _Remote Networks_ folder. + +This will edit an existing Vulnerability Protect Signature named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +vulnerabilityProtectSignature = {"folder":"Shared","default_action":{"alert":{}},"direction":"both","severity":"informational","affected_host":{"client":True},"cve":["CVE-12222"],"threatname":"Example Signature","signature":{"standard":[{"name":"ExampleSig","scope":"protocol-data-unit","and_condition":[{"name":"And Condition 1","or_condition":[{"name":"Or Condition 1","operator":{"less_than":{"context":"cip-ethernet-ip-req-instance-id","value":0}}}]}]}]},"threat_id":"41012"} +s.paVulnerabilityProtectSignatureEdit(vulnerabilityProtectSignature, "Remote Networks") +``` + +## Delete a Vulnerability Protect Signature +To delete a Vulnerability Protect Signature in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +vulnerabilityProtectSignature = { "threatname": "Example Signature" } +s.paVulnerabilityProtectSignatureDelete(vulnerabilityProtectSignature, "Remote Networks") +``` \ No newline at end of file diff --git a/examples/securityServices/WildfireAntiVirusProfiles.md b/examples/securityServices/WildfireAntiVirusProfiles.md new file mode 100644 index 0000000..2dbed0d --- /dev/null +++ b/examples/securityServices/WildfireAntiVirusProfiles.md @@ -0,0 +1,78 @@ +# Examples on how to work with Wildfire AntiVirus Profiles +In all examples, it will either return a success or failure when attempting the operation. + +## Authentication +First authenticate to the API service: +```python +from auth import saseAuthentication +from access import prismaAccess +from access import securityServices + +p = saseAuthentication.saseAuthentication() +p.prismaAccessAuthLoadToken() +n = prismaAccess.prismaAccess(p.saseToken) +``` + +Now we can proceed with the commands below. + +## List all Wildfire AntiVirus Profiles +To list all Wildfire AntiVirus Profiles within shared folder (it defaults to _Shared_ folder) +```python +s = securityServices.securityServices(n) + +s.paWildfireAntiVirusProfilesList() +``` + + +To list all Wildfire AntiVirus Profiles within a specific folder, e.g. _Shared_ (it defaults to _Shared_). +```python +s = securityServices.securityServices(n) + +s.paWildfireAntiVirusProfilesList("Shared") +``` + + +## Create a Wildfire AntiVirus Profile +To create a Wildfire AntiVirus Profile in the _Remote Networks_ folder (it defaults to _Shared_). + +```python +s = securityServices.securityServices(n) + +wildfireAntiVirusProfiles = {"name":"best-practice2","folder":"Shared","rules":[{"name":"default","application":["any"],"file_type":["any"],"direction":"both","analysis":"public-cloud"}],"description":"Best practice antivirus and wildfire analysis security profile"} +s.paWildfireAntiVirusProfilesCreate(wildfireAntiVirusProfiles) +``` + +This will create a Wildfire AntiVirus Profile in the _"Remote Networks"_ folder. + +```python +s = securityServices.securityServices(n) + +wildfireAntiVirusProfiles = {"name":"best-practice2","folder":"Shared","rules":[{"name":"default","application":["any"],"file_type":["any"],"direction":"both","analysis":"public-cloud"}],"description":"Best practice antivirus and wildfire analysis security profile"} +s.paWildfireAntiVirusProfilesCreate(wildfireAntiVirusProfiles, "Remote Networks") +``` + +## Edit a Wildfire AntiVirus Profile +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +To edit an existing Wildfire AntiVirus Profile in the _Remote Networks_ folder. + +This will edit an existing Wildfire AntiVirus Profile named _Sample Policy_. + +```python +s = securityServices.securityServices(n) + +wildfireAntiVirusProfiles = {"name":"best-practice2","folder":"Shared","rules":[{"name":"default","application":["any"],"file_type":["any"],"direction":"both","analysis":"public-cloud"}],"description":"Best practice antivirus and wildfire analysis security profile"} +s.paWildfireAntiVirusProfilesEdit(wildfireAntiVirusProfiles, "Remote Networks") +``` + +## Delete a Wildfire AntiVirus Profile +To delete a Wildfire AntiVirus Profile in the _Remote Networks_ folder. + +It defaults to _Shared_, so if you want it removed there, just remove the _"Remote Networks"_ argument + +```python +s = securityServices.securityServices(n) + +wildfireAntiVirusProfiles = { "name": "best-practice2" } +s.paWildfireAntiVirusProfilesDelete(wildfireAntiVirusProfiles, "Remote Networks") +``` \ No newline at end of file