Solution / Network security
PAN-OS Policy Evaluator4.1
Every device group, evaluated on its own terms.
A read-only desktop application and command-line evaluator for PAN-OS security policy. It reads CSV exports or live firewall and Panorama rulebases, evaluates every device group and VSYS as its own scope, and produces evidence for a human change review: shadows, conflicts, merge candidates, and a scored hygiene assessment. It never edits, commits, clears counters, or deploys policy.
- Tests passing
- 201
- Hygiene checks
- 40+
- Transports
- 3
- Hygiene dimensions
- 6
What's new
Estate-wide, transport-aware, still strictly read-only.
Release 4.1 turns a single-scope analyzer into an estate evaluator: every device group and VSYS on its own tab, with an SSH path for environments where API keys are not provisioned yet.
- v4.1
Every device group on its own tab
A live analysis discovers every Panorama device group plus the shared rulebase, or every firewall VSYS, and evaluates each separately. Pre and post rulebases stay together per device group. A Device Groups page summarizes all scopes, and a scope tab strip on every results page switches between them. A scope that cannot be read is marked failed without stopping the others.
- v4.1
SSH CLI fallback
When an API key is not provisioned or the XML API fails mid-run, policy is read over SSH with an allowlist of read-only show commands. Each connection chooses XML API, API with SSH fallback, or SSH only, and affected scopes record a warning.
- v4.1
Pinned SSH host keys
Before any login the evaluator negotiates key exchange only and shows the SHA-256 fingerprint for confirmation. An unknown or changed key aborts the connection before a credential is sent; changing a host or port clears the pin.
- v4.1
Per-scope estate exports
One audit folder per scope, an index, an estate summary, and a checksum manifest covering every scope.
- v4.1.1
SSH-first connection manager
SSH connections are first-class: transport-aware dialog, Discover and Test over SSH, a Credentials action that asks for exactly what the transport needs, and Forget Credentials that keeps the trusted host key.
- v4.0
Policy hygiene and live connections
Scored policy hygiene, live API connection tests and scope discovery, API key generation from a username and password, and a connection manager with enable toggles.
Read-only by construction
It can only ask. It can never change.
Each transport accepts a fixed allowlist. Anything outside it is refused before it reaches a device.
- XML API
- HTTPS XML API with an API key in the request header. Hostname and certificate verification always on; private CA bundles supported.
- API with SSH fallback
- Uses the API when a key exists; reads over SSH when it does not, or continues over SSH if an API call fails mid-run.
- SSH CLI
- Reads policy through the PAN-OS CLI only, with pinned host keys and an interactive, allowlisted session.
XML API allowlist
- type=keygen
- type=config with show or get
- show system info
- show rule-hit-count
SSH CLI allowlist
- set cli pager off
- set cli config-output-format xml
- set cli op-command-xml-output on
- show system info
- show devicegroups
- show config running xpath "<rulebase>"
- show rule-hit-count vsys vsys-name <vsys> rule-base security rules all
The three set commands change session output only, never configuration. Scope names are restricted and commands containing line breaks are refused.
Policy hygiene
Six dimensions, scored per scope, never guessed.
Shadow, usage, lint, lifecycle, compliance, and security each score 0 to 100 from per-rule severity penalties and roll up to a weighted grade from A to F. A dimension that cannot be rated shows N/A and is excluded rather than guessed. Later runs of the same scope report a trend.
| Analysis | Checks | What it examines |
|---|---|---|
| Usage | USE001-006 | Never hit since creation, zero hits, dead or stale beyond thresholds, entering a cold period, low activity. Protected tags, excluded actions, and young rules are skipped; short counter windows downgrade severity and confidence. |
| Lint | NAME, DOC, SEC001-006, LOG, CFG, PERF, DUP, CON | Naming and description, allow with any source, destination, service, or application, any-to-any zones, no security profile, no logging, disabled rules, member-count limits, identical match criteria, contradicting actions. |
| Lifecycle | LIF001-010 | Temporary and test rules, temporary rules without expiration, expired, expiring, or unreadable expiration tags, missing owner and ticket tags, long-disabled rules. |
| Compliance | PCI, HIPAA, NIST, CIS, SOX | Heuristic control mappings: PCI DSS v4.0 1.3.1 and 1.4.2, HIPAA 164.312(b) and (e)(1), NIST AC-4, SI-3, AU-12, CM-7, CIS-style exposure checks, and an optional SOX change reference. Not an audit or certification. |
| Tag catalog | Classification | TEMP, TEST, OWNER, TICKET, EXPIRATION, PROTECTED, and STANDARD classification, spelling-variant consolidation, disabled-only, single-use, and expired tags. |
| Density | Indices | Object reuse, zero-hit ratio, overlap density, lint violation rate, conditions per rule, a complexity index, security debt, and top recommendations. |
Hygiene items are review prompts, not change approvals. Compliance mappings are heuristic and do not constitute an audit or certification.
Analysis engine
Conservative by default.
- Missing usage stays unknown; explicit zero counters become review items, never automatic disable recommendations
- Duplicates, shadows, and conflicting actions found in position order within one scope and rulebase
- IPv4 and IPv6 containment, wildcards, zones, users, URL categories, schedules, and HIP match values
- Merge candidates limited to identical behavior with at most one changing dimension; intervening rules treated as ordering concerns
- Conclusions never cross scopes; a pre rule never shadows a post rule
- Invalid CSV rows fail the whole import with row-level errors; no rule is silently dropped
Stated limitations
- Address and service groups are not resolved, and dynamic objects are not expanded
- App-ID dependencies are not simulated
- Effective device order is not assembled from inheritance
- Combined coverage by multiple earlier rules is not proven
- Panorama hit counters are not aggregated across managed firewalls
Credentials and hardening
Secrets stay out of files, URLs, and errors.
| Item | Where it lives |
|---|---|
| API key | Session memory, a Windows DPAPI blob only when remembered, or an environment variable |
| API password | Never stored; sent once in the TLS body of key generation |
| SSH password | Session memory, DPAPI only when remembered, or an environment variable |
| SSH private key | Referenced by path, never copied |
| SSH host key | Pinned SHA-256 fingerprint in the connection profile |
Transport hardening
- Redirects refused; responses capped at 32 MiB
- DTD and entity declarations rejected in XML
- Bounded retries for 429 and 5xx gateway errors
- Secrets never in URLs and redacted from errors
- Atomic writes for connection profiles
- Staging directories keep partial exports from appearing complete
Audit evidence
Checksummed bundles for every scope.
A live export writes one complete audit bundle per device group or VSYS, an estate index and summary, and a manifest of SHA-256 checksums across all of it.
- report.html
- Human-readable audit report per scope
- analysis.json
- Authoritative analysis snapshot
- hygiene.json
- Hygiene findings, scores, and trend
- rules / findings / merges / hygiene / tags .csv
- Tabular evidence for review tooling
- analysis.xlsx
- Workbook export
- manifest.json
- SHA-256 checksums per bundle and across the estate
Command line and CI
The same engine runs headless for CI: CSV or live scopes, saved connections, and exit codes that gate pipelines. There are deliberately no key or password arguments.
policy_cli --connection "Edge" --all-scopes --fail-on High --min-health 70| Exit | Meaning |
|---|---|
| 0 | Everything completed below thresholds |
| 1 | Input, API, SSH, or export failure, including any unreadable scope (others still reported) |
| 2 | Reports written, but a severity or health threshold was exceeded |
Across the estate
From one rulebase to governed estate work.
Inside VEGA, Palo Alto policy hygiene, overlap, density, and drift surfaces run as evidence on the governed work graph across the whole estate.