Skip to main content

​
Purpose

This guide explains how to configure Palo Alto Panorama credentials required for integration, including:
  • Base URL
  • Username
  • Password
The integration allows AirMDR to connect to Palo Alto Panorama, retrieve security events, firewall logs, device context, and configuration-related information based on the permissions assigned to the Panorama administrator account.

​
Prerequisites

  • Access to the Palo Alto Panorama web interface.
  • A Panorama administrator account with permission to create or manage admin users.
  • Network connectivity from AirMDR or the configured remote agent to the Panorama management interface.
  • HTTPS access enabled on the Panorama management interface.
  • Required XML API permissions enabled for the integration user.

​
Supported Versions

ComponentSupported/Recommended
Palo Alto PanoramaPAN-OS 10.x, 11.x, and later supported Panorama versions
Authentication MethodUsername and Password-based authentication
API TypePAN-OS XML API
Connection ProtocolHTTPS
Default PortTCP 443
Confirm the exact PAN-OS version and API compatibility with your internal security and network teams before enabling the integration.

​
Authentication

Palo Alto Panorama uses administrator credentials to authenticate API requests. The integration requires a dedicated Panorama administrator account.

​
Required Credentials

CredentialDescriptionExample
Base URLPanorama management URL or IP addresshttps://panorama.example.com
UsernameDedicated Panorama administrator usernameairmdr_api_user
PasswordPassword for the Panorama administrator accountStored securely in AirMDR

​
Role-Based Access Considerations

Create a dedicated administrator account for the integration instead of using a personal or shared admin account. Recommended access:
  • Use a custom Panorama Admin Role.
  • Enable only the required XML API permissions.
  • Prefer read-only access wherever possible.
  • Avoid using the default admin or full superuser account unless explicitly required for testing.
Recommended XML API permissions:
XML API PermissionRecommended AccessPurpose
LogEnabledRetrieve traffic, threat, system, and security logs
ReportEnabledRetrieve available report data
Operational RequestsEnabled if requiredRun operational queries
ConfigurationRead-only / limitedRetrieve device and policy context
CommitDisabledNot required for monitoring integrations
Import / ExportDisabled unless requiredAvoid unnecessary file-level access
The exact permissions may vary based on the integration scope. Use least-privilege access wherever possible.

​
Setup Steps

1

Identify the Panorama Base URL

  1. Log in to the Palo Alto Panorama web interface. Example: https://<panorama-management-ip>
  2. After logging in, verify the URL in the browser address bar.
  3. Copy the base URL without any extra path.
    Correct format:
    https://panorama.example.com
    Or:
    https://192.168.10.50
    Do not include UI paths such as /php/login.php, /index.php, or /api.
    Incorrect examples:
    https://panorama.example.com/php/login.php
    https://panorama.example.com/index.php
    https://panorama.example.com/api
  4. Use this value as the Base URL in AirMDR.
    If Panorama is accessed through a private network, VPN, or jump host, ensure the AirMDR remote agent can reach the same Base URL.
2

Create a Custom Panorama Admin Role

  1. In the Panorama UI, navigate to Panorama → Admin Roles.
  2. Click Add.
  3. Enter a role name.
    Example: AirMDR_ReadOnly_API_Role
  4. Set the role scope as Panorama.
  5. Configure Web UI permissions as required.
    Recommended: Read Only
  6. Go to the XML API permission section.
  7. Enable the required XML API permissions. Recommended minimum:
    • Log
    • Report
    • Operational Requests
    • Configuration, if device or policy context is required
  8. Disable permissions that are not required, such as:
    • Commit
    • Import
    • Export
    • User-ID Agent, unless specifically needed
  9. Click OK.
  10. Commit the change if required by your Panorama change process.
3

Create a Dedicated Panorama Administrator User

  1. In the Panorama UI, navigate to Panorama → Administrators.
  2. Click Add.
  3. Enter the administrator username.
    Example: airmdr_api_user
  4. Configure authentication.
    You can use either:
    • Local password authentication
    • Authentication Profile, such as LDAP, RADIUS, TACACS+, or SAML, if supported by your organization.
  5. If using local authentication, enter and confirm the password.
  6. Under Administrator Type, select Custom Panorama Admin.
  7. Select the custom role created earlier.
    Example: AirMDR_ReadOnly_API_Role
  8. Click OK.
  9. Commit the change if required.
  10. Store the username and password securely.
Do not reuse a personal administrator account for integration access.
4

Validate the Username and Password

Before configuring the integration, verify that the credentials are working.
  1. Open a browser.
  2. Go to the Panorama Base URL. Example: https://panorama.example.com
  3. Log in using the integration username and password.
  4. Confirm that the user can access Panorama based on the assigned role.
  5. Log out after validation.
    If the login fails, confirm that the account is not locked and the password has not expired.

​
Integration Credential Requirements

Use the following values in the AirMDR integration configuration screen:
AirMDR FieldRequired ValueWhere to Obtain
Base URLThe HTTPS URL or IP address of your Palo Alto Panorama management interface (for example, https://panorama.example.com or https://192.168.1.100)Copy the URL from your browser after logging in to the Panorama web interface.
UsernameThe dedicated Panorama administrator username created for the integrationNavigate to Panorama → Administrators and use the configured integration account.
PasswordThe password associated with the integration administrator accountUse the password configured when creating or updating the administrator account in Panorama.
For improved security, create a dedicated read-only administrator account for the integration instead of using the default or personal administrator credentials. Ensure the account has the minimum permissions required for API access.

​
Validate Connectivity

Use the following curl command to verify connectivity and authenticate with the Palo Alto Panorama XML API using the configured Base URL, Username, and Password.
Request Command:
curl -k -X GET "https://<PANORAMA_BASE_URL>/api/?type=keygen&user=<USERNAME>&password=<PASSWORD>"

​
Example

curl -k -X GET "https://panorama.example.com/api/?type=keygen&user=airmdr_api_user&password=MySecurePassword123!"
<response status=“success”> <result> <key>LUFRPT14MW5xOEo1R09KV2V5MTIzNDU2Nzg5</key>
</result>
</response>
<response status=“error”>
<msg> <line>Invalid credentials.</line>
</msg>
</response>
A successful response confirms that the Panorama management interface is reachable and that the supplied username and password are valid. The returned API key is generated by Panorama for XML API authentication and can be used to verify credential validity.

​
Configure Palo Alto Panorama in AirMDR Integrations Dashboard

  1. Navigate to AirMDR, provide the credentials and click Login
  2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select Integrations.
  3. Use the search option, enter the keyword “Palo Alto Panorama”, select the Connections tab, and click + Create button.
  4. Enter an unique name to the Instance (e.g., your org name-PaloAltoPanorama) to easily identify the user connection by AirMDR.
  5. Enter the application credentials like Base URL, User Name and Password in the Authentication Details field params, and click Save.

​
Skills provided by this Integration

Skill IDPurpose
Get Palo Alto Panorama LogsRetrieve logs from Palo Alto Panorama. Submits a log job to the PAN-OS XML API, polls until completion, and returns parsed log entries. Supports standard PAN-OS log types and optional PAN-OS filter syntax for narrowing results.
To view the details of Input Parameters and Output for the respective skills

​
Additional Information

ErrorPossible CauseResolution
Invalid credentialsIncorrect username or passwordRe-enter credentials and validate login in Panorama UI
Connection timeoutNetwork path blockedConfirm routing, firewall rules, VPN, and TCP 443 access
SSL certificate errorSelf-signed or untrusted certificateUse a trusted certificate or configure trusted certificate handling as per company policy
Permission deniedAdmin role does not have required XML API permissionsUpdate the custom Admin Role and enable required XML API permissions
Empty logs or no dataLog permission missing or no matching logs availableValidate Log API access and confirm logs exist in Panorama
Account lockedToo many failed login attemptsUnlock the administrator account from Panorama
API request failedIncorrect Base URL formatUse only the base Panorama URL without /api or UI paths

​
Where to Find Logs in Panorama

  • Use the Panorama UI to review access and API activity.
    Recommended locations: Monitor → Logs → System
  • You can filter for API-related activity.
    Example filter: (description contains 'API')
  • You can also review administrator login events from the system logs.

​
Sample Log Entries

Successful login example:
Admin user airmdr_api_user logged in from 10.10.20.15
API key generation example:
API KeyGen was executed for user airmdr_api_user
Failed login example:
failed authentication for user airmdr_api_user
Log TypeRecommended Review
System logsReview authentication and API activity
Configuration logsReview admin or role changes
Threat / Traffic logsValidate log availability
Audit logsTrack credential and permission changes

​
Do

  • Create a dedicated administrator account for AirMDR.
  • Use least-privilege access.
  • Enable only required XML API permissions.
  • Use HTTPS for Panorama API communication.
  • Store credentials in a secure vault or approved secret manager.
  • Rotate passwords based on internal security policy.
  • Monitor API and administrator login activity.
  • Restrict access by source IP where possible.
  • Disable Commit, Import, and Export permissions unless required.

​
Avoid

  • Do not use the default admin account for integrations.
  • Do not assign full Superuser access unless required for troubleshooting.
  • Do not share credentials in email, tickets, or screenshots.
  • Do not configure the Base URL with /api, /index.php, or login page paths.
  • Do not leave unused integration accounts enabled.
  • Do not ignore repeated failed login attempts.
  • 📧 Contact AirMDR Support through your designated support channel.
  • 🔁 Rotate credentials regularly. Recommended cadence: As per internal security policy
  • 🔄 Reconnect in AirMDR when secrets are changed.
  • When raising a support request, include:
    • Panorama version
    • Integration name
    • Base URL format, without exposing credentials
    • Error message or failed response
    • Timestamp of the failed attempt
    • Screenshot of the integration status
    • Relevant Panorama system log entry
  • Update the integration when:
    • The Panorama hostname or IP address changes.
    • The administrator password is rotated.
    • The administrator role is modified.
    • PAN-OS or Panorama is upgraded.
    • Firewall or device group access scope changes.
    • The remote agent or network path changes.

      Recommended maintenance tasks:
      ActivityRecommended Frequency
      Review admin account usageMonthly
      Rotate passwordAs per company policy
      Review role permissionsQuarterly
      Validate connectionAfter upgrades or network changes
      Review failed login attemptsWeekly

​
Data Exchanged

Data TypeDirectionDescription
API TokenAirMDR → GravwellUsed for authentication.
Search QueryAirMDR → GravwellUsed to retrieve required telemetry.
AlertsGravwell → AirMDRReturned if alert read access is configured.
Tags / Telemetry MetadataGravwell → AirMDRUsed to identify available data sources.
Search ResultsGravwell → AirMDRUsed for enrichment and investigation.

​
Ports and Endpoints

ItemValue
ProtocolHTTPS
Default Port443
Instance URL Formathttps://<gravwell-hostname>
Example API Endpoint/api/tags
Search Parse Endpoint/api/parse
Direct Search Endpoint/api/search/direct
Use HTTPS with a valid TLS certificate wherever possible.

​