Loading_
Loading_
Pulls the running policy via the XML API and reports shadowed rules, any-any-any rules, rules with no hit count in 90 days, and disabled rules nobody ever cleaned up.
"""Palo Alto policy hygiene report via the PAN-OS XML API. Read-only. Emits findings plus a reviewable change plan. pip install requests export PAN_API_KEY=... python panos_rule_hygiene.py --host fw01.corp.local --vsys vsys1 --days 90""" from __future__ import annotations import argparseimport osimport sysimport urllib3import xml.etree.ElementTree as ETfrom dataclasses import dataclass, field import requests urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) ANY = {"any"} @dataclassclass Rule: name: str214 more lines behind the library licence
panos_rule_hygiene.py · 8.9 KB · 3 dependencies documented
This one is behind the licence because it is the kind of script that does real damage when it is wrong — and the version above has already been broken and fixed by two engineers in a live estate.
Firewall policies only grow. A rule added for a migration in 2021 is still there, still permitting, and nobody will remove it because nobody can prove what it does.
This uses the hit-count data the device already collects, plus shadow analysis, so removal candidates come with evidence rather than a hunch. A rule with zero hits in 90 days and a broader rule above it is a safe delete; a rule with zero hits and nothing above it needs a conversation.
Read-only against the API. It emits a change plan as a set of XML API delete calls that you review and run yourself — it will not modify a firewall.
| Name | Type | Required | Description |
|---|---|---|---|
--host | string | Required | Firewall management address. |
--vsys | string | Optional | Virtual system, default vsys1. |
--plan | path | Optional | Write a reviewable delete plan. |
The platform turns any script into a governed automation — versioned, gated, audited and reversible.