Skip to main content

​
Purpose

This guide explains how to configure Palo Alto Panorama credentials required for integration, including:
  • Base URL
  • Username
  • Password
The integration allows AirMDR to connect to Palo Alto Panorama, retrieve security events, firewall logs, device context, and configuration-related information based on the permissions assigned to the Panorama administrator account.

​
Prerequisites

  • Access to the Palo Alto Panorama web interface.
  • A Panorama administrator account with permission to create or manage admin users.
  • Network connectivity from AirMDR or the configured remote agent to the Panorama management interface.
  • HTTPS access enabled on the Panorama management interface.
  • Required XML API permissions enabled for the integration user.

​
Supported Versions

Confirm the exact PAN-OS version and API compatibility with your internal security and network teams before enabling the integration.

​
Authentication

Palo Alto Panorama uses administrator credentials to authenticate API requests. The integration requires a dedicated Panorama administrator account.

​
Required Credentials

​
Role-Based Access Considerations

Create a dedicated administrator account for the integration instead of using a personal or shared admin account. Recommended access:
  • Use a custom Panorama Admin Role.
  • Enable only the required XML API permissions.
  • Prefer read-only access wherever possible.
  • Avoid using the default admin or full superuser account unless explicitly required for testing.
Recommended XML API permissions:
The exact permissions may vary based on the integration scope. Use least-privilege access wherever possible.

​
Setup Steps

1

Identify the Panorama Base URL

  1. Log in to the Palo Alto Panorama web interface. Example: https://<panorama-management-ip>
  2. After logging in, verify the URL in the browser address bar.
  3. Copy the base URL without any extra path.
    Correct format:
    https://panorama.example.com
    Or:
    https://192.168.10.50
    Do not include UI paths such as /php/login.php, /index.php, or /api.
    Incorrect examples:
    https://panorama.example.com/php/login.php
    https://panorama.example.com/index.php
    https://panorama.example.com/api
  4. Use this value as the Base URL in AirMDR.
    If Panorama is accessed through a private network, VPN, or jump host, ensure the AirMDR remote agent can reach the same Base URL.
2

Create a Custom Panorama Admin Role

  1. In the Panorama UI, navigate to Panorama → Admin Roles.
  2. Click Add.
  3. Enter a role name.
    Example: AirMDR_ReadOnly_API_Role
  4. Set the role scope as Panorama.
  5. Configure Web UI permissions as required.
    Recommended: Read Only
  6. Go to the XML API permission section.
  7. Enable the required XML API permissions. Recommended minimum:
    • Log
    • Report
    • Operational Requests
    • Configuration, if device or policy context is required
  8. Disable permissions that are not required, such as:
    • Commit
    • Import
    • Export
    • User-ID Agent, unless specifically needed
  9. Click OK.
  10. Commit the change if required by your Panorama change process.
3

Create a Dedicated Panorama Administrator User

  1. In the Panorama UI, navigate to Panorama → Administrators.
  2. Click Add.
  3. Enter the administrator username.
    Example: airmdr_api_user
  4. Configure authentication.
    You can use either:
    • Local password authentication
    • Authentication Profile, such as LDAP, RADIUS, TACACS+, or SAML, if supported by your organization.
  5. If using local authentication, enter and confirm the password.
  6. Under Administrator Type, select Custom Panorama Admin.
  7. Select the custom role created earlier.
    Example: AirMDR_ReadOnly_API_Role
  8. Click OK.
  9. Commit the change if required.
  10. Store the username and password securely.
Do not reuse a personal administrator account for integration access.
4

Validate the Username and Password

Before configuring the integration, verify that the credentials are working.
  1. Open a browser.
  2. Go to the Panorama Base URL. Example: https://panorama.example.com
  3. Log in using the integration username and password.
  4. Confirm that the user can access Panorama based on the assigned role.
  5. Log out after validation.
    If the login fails, confirm that the account is not locked and the password has not expired.

​
Integration Credential Requirements

Use the following values in the AirMDR integration configuration screen:
For improved security, create a dedicated read-only administrator account for the integration instead of using the default or personal administrator credentials. Ensure the account has the minimum permissions required for API access.

​
Validate Connectivity

Use the following curl command to verify connectivity and authenticate with the Palo Alto Panorama XML API using the configured Base URL, Username, and Password.
Request Command:

​
Example

<response status=“success”> <result> <key>LUFRPT14MW5xOEo1R09KV2V5MTIzNDU2Nzg5</key>
</result>
</response>
<response status=“error”>
<msg> <line>Invalid credentials.</line>
</msg>
</response>
A successful response confirms that the Panorama management interface is reachable and that the supplied username and password are valid. The returned API key is generated by Panorama for XML API authentication and can be used to verify credential validity.

​
Configure Palo Alto Panorama in AirMDR Integrations Dashboard

  1. Navigate to AirMDR, provide the credentials and click Login
  2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select Integrations.
  3. Use the search option, enter the keyword “Palo Alto Panorama”, select the Connections tab, and click + Create button.
  4. Enter an unique name to the Instance (e.g., your org name-PaloAltoPanorama) to easily identify the user connection by AirMDR.
  5. Enter the application credentials like Base URL, User Name and Password in the Authentication Details field params, and click Save.

​
Skills provided by this Integration

To view the details of Input Parameters and Output for the respective skills

​
Additional Information

​
Where to Find Logs in Panorama

  • Use the Panorama UI to review access and API activity.
    Recommended locations: Monitor → Logs → System
  • You can filter for API-related activity.
    Example filter: (description contains 'API')
  • You can also review administrator login events from the system logs.

​
Sample Log Entries

Successful login example:
API key generation example:
Failed login example:

​
Do

  • Create a dedicated administrator account for AirMDR.
  • Use least-privilege access.
  • Enable only required XML API permissions.
  • Use HTTPS for Panorama API communication.
  • Store credentials in a secure vault or approved secret manager.
  • Rotate passwords based on internal security policy.
  • Monitor API and administrator login activity.
  • Restrict access by source IP where possible.
  • Disable Commit, Import, and Export permissions unless required.

​
Avoid

  • Do not use the default admin account for integrations.
  • Do not assign full Superuser access unless required for troubleshooting.
  • Do not share credentials in email, tickets, or screenshots.
  • Do not configure the Base URL with /api, /index.php, or login page paths.
  • Do not leave unused integration accounts enabled.
  • Do not ignore repeated failed login attempts.
  • 📧 Contact AirMDR Support through your designated support channel.
  • 🔁 Rotate credentials regularly. Recommended cadence: As per internal security policy
  • 🔄 Reconnect in AirMDR when secrets are changed.
  • When raising a support request, include:
    • Panorama version
    • Integration name
    • Base URL format, without exposing credentials
    • Error message or failed response
    • Timestamp of the failed attempt
    • Screenshot of the integration status
    • Relevant Panorama system log entry
  • Update the integration when:
    • The Panorama hostname or IP address changes.
    • The administrator password is rotated.
    • The administrator role is modified.
    • PAN-OS or Panorama is upgraded.
    • Firewall or device group access scope changes.
    • The remote agent or network path changes.

      Recommended maintenance tasks:

​
Data Exchanged

​
Ports and Endpoints

Use HTTPS with a valid TLS certificate wherever possible.

​