WireLurkerDetector

Script for detecting the WireLurker malware family

pan-os-python

The PAN-OS SDK for Python is a package to help interact with Palo Alto Networks devices (including physical and virtualized Next-generation Firewalls and Panorama). The pan-os-python SDK is object oriented and mimics the traditional interaction with the device via the GUI or CLI/API.

ansible-pan

Ansible modules for Palo Alto Networks NGFWs

iron-skillet

IronSkillet is a set of day-one configuration templates for PAN-OS to enable alignment with security best practices. See the Quick Start section below to get started using the template configurations.

pan-os-ansible

Ansible collection for easy automation of Palo Alto Networks next generation firewalls and Panorama, in both physical and virtual form factors.

minemeld-core

Engine of MineMeld

terraform-templates

This repo contains Terraform templates to deploy infrastructure on AWS and Azure and to secure them using the Palo Alto Networks Next Generation Firewalls

azure

VM-Series ARM Templates for Microsoft Azure

Splunk-Apps

Palo Alto Networks App for Splunk leverages the data visibility provided by Palo Alto Networks next-generation firewalls and endpoint security with Splunk's extensive investigation and visualization capabilities to deliver an advanced security reporting and analysis tool.

IAM-Deescalate

IAM-Deescalate helps mitigate privilege escalation risk in AWS identity and access management (IAM)

aws

VM-Series for Amazon Web Services

aws-transit-vpc

automated AWS transit vpc

Prisma-Enhanced-Remediation

Create custom auto-remediation solutions using serverless functions in the cloud.

minemeld-node-prototypes

Prototypes for MineMeld nodes

pan-cortex-data-lake-python

Python idiomatic SDK for Cortex™ Data Lake.

pyjarm

pyJARM is a library for doing JARM fingerprinting using python

TransitGatewayDeployment

Creates a Transit Gateway with two server VPCs and a security VPC

prismacloud-api-python

Prisma Cloud utility scripts, and a Python SDK for Prisma Cloud APIs.

pan-fca

Flexible Cloud Automation

autofocus-lenz

A command line utility to aid in using autofocus for IR and research

report_to_misp

Parse a report and import the events into MISP

prisma-cloud-compute-sample-code

Example scripts, snippets, and other documents related to Prisma Cloud Compute

Azure-Transit-VNet

Azure security with VM-Series in a hub-and-spoke architecture

evident-automation

Evident Security Platform Automation

minemeld-misp

MineMeld nodes for MISP

autofocus-client-library

A python client library for interfacing with the autofocus rest services

pan-stix

pan-stix

Splunk_TA_paloalto

The Palo Alto Networks Add-on for Splunk allows a Splunk® Enterprise or Splunk Cloud administrator to collect data from Palo Alto Networks Next-Generation Firewall devices and Advanced Endpoint Protection.

prismacloud-cli

The Prisma Cloud CLI is a command line interface for Prisma Cloud by Palo Alto Networks.

tcpsession

A python library to extract TCP sessions from PCAPs.

SafeNetworking

Read only mirror. To contribute or submit issues, please go to the website link --->

misp-to-autofocus

Script for pulling events from a MISP database and converting them to Autofocus queries.

gcp-two-tier

VM-Series templates for Google Cloud Platform

youtube-miner

MineMeld Miner for Youtube channels

pcs-serverless-syslog

Prisma Cloud serverless function that can accept webhook and send alerts to syslog, S3, and SQS

panos-bootstrapper-ui

PAN-OS Bootstrapper UI provides a simple, example web-UI that consumes the PAN-OS Bootstrapper utility API.

panos-bootstrapper

A Utility to bootstrap a new PAN-OS NGFW. This utility provides an API only. An example web interface is provided here: https://github.com/PaloAltoNetworks/panos-bootstrapper-ui

Splunk-App-Data-Generator

Sample data generator for the Splunk for Palo Alto Networks app.

GCP-AutoScaling

Google Cloud Auto Scaling Available Now

microsoft_azure_virtual_wan

Implements the automation and integration framework to work with Azure Virtual WAN's and PANW to create VPN connections.

ciscoise-miner

Cisco ISE session miner using pxGrid bulk download REST API

pan-python-tools

A collection of utilities that users of pan-python might find useful

PrismaCFNOnboarding

Cloudformation Script to onboard accounts to Redlock

PAN_DUG

Dynamic User Group code for Palo Alto Networks devices

ignite2018-how16

repo for ignite 2018 hand on lab

XFF-to-User-ID-mapping

This solution maps XFF header source IP to User-ID allowing for blocking malicious sources when the VM-Series is behind a device that performs source NAT such as a load balancer.

pc-python-integration

Python3 API toolkit for Prisma Cloud APIs

prisma-access-ip-api-client

Python client to retrieve prisma access IP Addresses from API

pcs_alert_tags_acctgrp

Prisma Cloud alert csv output plus tags and account group names

skilletlib

Tools and base classes for working with Skillets. Issues and feature requests are tracked here: https://gitlab.com/panw-gse/as/skilletlib/-/issues

SkilletBuilder

Docs and tutorial for Skillet template building

Intel-Framework

Intel Importer

pan-threat-vault-python

Python interface to the Palo Alto Networks Threat Vault API

cortex-xpanse-python-sdk

Python SDK for Cortex™ Xpanse

custom-imaging

Create custom VM-Series images on public cloud with upgraded PanOS, Plugin and Content versions

prisma-cloud-ansible

Ansible collection for Prisma Cloud

minemeld-msgraph-secapi

MineMeld nodes for Microsoft Graph Security API

redlock-automation

gridmeld

Cisco ISE pxGrid to Palo Alto Networks MineMeld Gateway

pan-tort

pan_guard_duty

PrismaSASECloudManaged-Python

A python framework to use the Prisma Access API to configure Cloud Managed

sharkbait

prisma-cloud-compute-splunk

Splunk app for ingesting Prisma Cloud Compute incidents and forensics

panos-query-scripts

scripts to query information from a PAN-OS NGFW

host-defender-token-refresher

minemeld-taxii-ng

New TAXII Miner for MineMeld

azure-vm-monitoring

azure-new-v2

aws-elbhelper

Very targeted script that allows update of the FW NAT rules based on the dynamic AWS' ELB VIP changes

prisma-sase-sdk-python

Prisma SASE SDK

cloud-ngfw-aws-examples

Cloud Formation template to deploy and manage the Cloud NGFW on AWS.

pcs-migration-management

Python script for migrating Prisma Cloud Tenants and for syncing changes across all managed Tenants.

skillet_ansible

Ansible collection for Skillets

aws_security_hub

Integration of IOC from AWS Security Hub with the VM-Series Firewall

ansible-role-spatula

This Ansible role applies security best practice templates to Palo Alto Networks devices.

pcs_export_policies

Script for exporting Prisma Cloud policies and their associated RQL into a CSV output file.

vistoq

MSSP Demo Portal - Art of the Possible

pan-cnc

CNC: Chevy's, not Cadillacs. Rapid UI prototyping for all Palo Alto Networks WWSE demos and pocs.

pan_nlb_v1

This is the V1 (CFT) template to deploy an NLB architecture to AWS.

firebreak-box

firebreak: Fight fire with WildFire

pc-rql-search

Python Script for Prisma Cloud CSPM to run RQL queries and record results in a CSV file

pangraft

panapi

autocombo

pcs-compare-csv-accounts-to-tenant

Utilize a CSV list of accounts to see if a list of accounts exists in a Prisma Cloud tenant

pcs-acctgrps-labels

Prisma_Cloud_AWS_Onboard

minemeld-prisma-access

Miner for Prisma Access API

pan_aws_security_hub

This implementation integrates the AWS Security Hub insights and makes it actionable on the VM-Series FW.

minemeld-wd-atp

MineMeld nodes for MSFT WD ATP API

wildcardip-miner

MineMeld Miner extension to expand IPv4 wildcards into list of corresponding CDIR's

minemeld-cef

MineMeld Output node for CEF format

SyncServiceNow

A proof of concept to demonstrate synchronization of server assets and their attributes from ServiceNow into registered IP tags and dynamic address groups on a Palo Alto Networks next-generation firewall.

pc-csv-alert-dismissal

Simple script to dismiss alerts from a supplied CSV file.

pcs-alert-dismissal

Python3 tool for automatically dismissing alerts in Prisma Cloud for a deleted cloud account

cdl-decompress-proxy-sentinel-ingest

Proxy application for ingesting into Azure sentinel from Cortex Data Lake

pan-iot-security-python

Python interface to the Palo Alto Networks IoT Security API

pcs_rql_search

This script will run RQL search and take the results and format them into CSV (based on current CSV output on Investigate page)

SLI

panos-set-additional-threat-log

In PAN-OS 8.1.2, Palo Alto introduced additional threat logging that is enabled with an OP/CLI command. This application is a tool that allows you to enable the feature on multiple firewalls directly or through Panorama.

qwiklabs-autoscale

pcs-alert-rpt-email

Generates alert report via email - reporting on top risks in last 24 hrs, top high risks and all risks, then breakdown by account. Also top 5 policies by count.

GSP490

Qwiklab- Palo Alto Networks VM-Series Firewall: Securing the GKE Perimeter

pcs_sqs_to_syslog

Prisma Cloud SQS poller to syslog

panos-logging-skillets

Suite of helper skillets and playbooks to simplify and validate Cortex Data Lake deployments

AccountGroupUpdate

autoscale

VM-Series AutoScale Qwiklab

panw-gse.skillets

Ansible roles and libraries for working with PAN-OS, Panorama, and Pan-Validation Skillets

onboard_aws_prisma

ansible-role-vmware-dagger

An Ansible role that synchronizes VMware vCenter virtual machine IP addresses and tags with PAN-OS.

pan-tort-source

Source code for using Autofocus (and other applications) to discern hash coverage of known and unknown artifacts.

nuage-connector

minemeld-threatconnect

MineMeld extension for ThreatConnect

APIC-EPG-DAG-Update

Script to read learned Cisco APIC EPG Endpoints and update PANW dynamic address groups.

AWSSG

Update AWS SG to quarantine hosts based upon trigger from FW threat log Edit Add topics

nsx-ngfw-version-match

Upgrade all NSX-based VM-1000-HV firewalls to the same version

cfn-vm-series-helper-demo

demo demo