Palo Alto Networks Advisories API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Advisories API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Advisories
  description: Query and retrieve PSIRT security advisories.
paths:
  /advisories:
    get:
      operationId: listAdvisories
      summary: Palo Alto Networks List All Security Advisories
      description: Returns a paginated list of published PSIRT security advisories. Supports filtering by severity, affected product, and sorting by publication date or CVSS score. This endpoint is publicly accessible and does not require authentication. Results include advisory metadata, CVE identifiers, severity ratings, and affected product summaries.
      tags:
      - Advisories
      parameters:
      - name: severity
        in: query
        description: Filter advisories by severity level.
        schema:
          type: string
          enum:
          - NONE
          - LOW
          - MEDIUM
          - HIGH
          - CRITICAL
        example: MEDIUM
      - name: affected_product
        in: query
        description: 'Filter by affected product name. Examples: PAN-OS, Cortex XDR Agent, Prisma Cloud, GlobalProtect, Cortex XSOAR.'
        schema:
          type: string
        example: example-affected_product
      - name: sort
        in: query
        description: Field and direction to sort results by.
        schema:
          type: string
          enum:
          - -publishedDate
          - publishedDate
          - -cvssScore
          - cvssScore
          default: -publishedDate
        example: -publishedDate
      - name: limit
        in: query
        description: Maximum number of advisories to return per page.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      responses:
        '200':
          description: Security advisories returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of advisories matching the query.
                  offset:
                    type: integer
                    description: Current pagination offset.
                  limit:
                    type: integer
                    description: Number of results per page.
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Advisory'
              examples:
                ListAdvisories200Example:
                  summary: Default listAdvisories 200 response
                  x-microcks-default: true
                  value:
                    total: 156
                    offset: 236
                    limit: 422
                    data:
                    - advisory_id: '234493'
                      cve_id: '128548'
                      title: Corporate Agent 18
                      description: Rule suspicious endpoint investigation firewall suspicious blocked configured.
                      severity: CRITICAL
                      cvss_score: 7.06
                      cvss_vector: example-cvss_vector
                      cwe: example-cwe
                      affected_products:
                      - product: example-product
                        versions:
                        - version: 3.0.0
                          status: Unaffected
                      - product: example-product
                        versions:
                        - version: 5.7.5
                          status: Unaffected
                        - version: 7.8.2
                          status: Fixed
                      fixed_versions:
                      - 1.5.8
                      - 8.6.4
                      workarounds: example-workarounds
                      exploit_status: None
                      published_date: '2025-03-02T01:26:35Z'
                      last_modified_date: '2025-08-23T12:10:49Z'
                      references:
                      - url: https://vpn.test-corp.net/3c1d96
                        description: Traffic threat blocked activity incident monitoring violation Security Security.
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListAdvisories400Example:
                  summary: Default listAdvisories 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware on activity detected policy configured investigation rule Security alert network alert.
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListAdvisories500Example:
                  summary: Default listAdvisories 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware on activity detected policy configured investigation rule Security alert network alert.
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /advisories/{advisory_id}:
    get:
      operationId: getAdvisory
      summary: Palo Alto Networks Get a Single Security Advisory
      description: Returns full details for a specific security advisory by its advisory ID. Includes the complete description, CVSS scoring, affected product versions, fixed versions, available workarounds, and references to external resources such as NVD entries.
      tags:
      - Advisories
      parameters:
      - name: advisory_id
        in: path
        required: true
        description: Palo Alto Networks advisory identifier (e.g., PAN-SA-2024-0001).
        schema:
          type: string
        example: '759733'
      responses:
        '200':
          description: Advisory details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Advisory'
              examples:
                GetAdvisory200Example:
                  summary: Default getAdvisory 200 response
                  x-microcks-default: true
                  value:
                    advisory_id: '234493'
                    cve_id: '128548'
                    title: Corporate Agent 18
                    description: Rule suspicious endpoint investigation firewall suspicious blocked configured.
                    severity: CRITICAL
                    cvss_score: 7.06
                    cvss_vector: example-cvss_vector
                    cwe: example-cwe
                    affected_products:
                    - product: example-product
                      versions:
                      - version: 3.0.0
                        status: Unaffected
                    - product: example-product
                      versions:
                      - version: 5.7.5
                        status: Unaffected
                      - version: 7.8.2
                        status: Fixed
                    fixed_versions:
                    - 1.5.8
                    - 8.6.4
                    workarounds: example-workarounds
                    exploit_status: None
                    published_date: '2025-03-02T01:26:35Z'
                    last_modified_date: '2025-08-23T12:10:49Z'
                    references:
                    - url: https://vpn.test-corp.net/3c1d96
                      description: Traffic threat blocked activity incident monitoring violation Security Security.
        '400':
          description: Invalid advisory ID format.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAdvisory400Example:
                  summary: Default getAdvisory 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware on activity detected policy configured investigation rule Security alert network alert.
        '404':
          description: Advisory not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAdvisory404Example:
                  summary: Default getAdvisory 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware on activity detected policy configured investigation rule Security alert network alert.
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAdvisory500Example:
                  summary: Default getAdvisory 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware on activity detected policy configured investigation rule Security alert network alert.
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /advisories/cve/{cve_id}:
    get:
      operationId: getAdvisoryByCVE
      summary: Palo Alto Networks Get Advisories by CVE ID
      description: Returns all security advisories associated with a specific CVE identifier. A single CVE may be referenced in multiple advisories when the vulnerability affects several Palo Alto Networks products. Returns an array of matching advisory objects.
      tags:
      - Advisories
      parameters:
      - name: cve_id
        in: path
        required: true
        description: CVE identifier (e.g., CVE-2024-3400).
        schema:
          type: string
          pattern: ^CVE-\d{4}-\d{4,}$
        example: '764107'
      responses:
        '200':
          description: Advisories for the CVE returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Number of advisories found for the CVE.
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Advisory'
              examples:
                GetAdvisoryByCve200Example:
                  summary: Default getAdvisoryByCVE 200 response
                  x-microcks-default: true
                  value:
                    total: 539
                    data:
                    - advisory_id: '234493'
                      cve_id: '128548'
                      title: Corporate Agent 18
                      description: Rule suspicious endpoint investigation firewall suspicious blocked configured.
                      severity: CRITICAL
                      cvss_score: 7.06
                      cvss_vector: example-cvss_vector
                      cwe: example-cwe
                      affected_products:
                      - product: example-product
                        versions:
                        - version: 3.0.0
                          status: Unaffected
                      - product: example-product
                        versions:
                        - version: 5.7.5
                          status: Unaffected
                        - version: 7.8.2
                          status: Fixed
                      fixed_versions:
                      - 1.5.8
                      - 8.6.4
                      workarounds: example-workarounds
                      exploit_status: None
                      published_date: '2025-03-02T01:26:35Z'
                      last_modified_date: '2025-08-23T12:10:49Z'
                      references:
                      - url: https://vpn.test-corp.net/3c1d96
                        description: Traffic threat blocked activity incident monitoring violation Security Security.
        '400':
          description: Invalid CVE ID format.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAdvisoryByCve400Example:
                  summary: Default getAdvisoryByCVE 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware on activity detected policy configured investigation rule Security alert network alert.
        '404':
          description: No advisories found for the specified CVE.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAdvisoryByCve404Example:
                  summary: Default getAdvisoryByCVE 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware on activity detected policy configured investigation rule Security alert network alert.
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetAdvisoryByCve500Example:
                  summary: Default getAdvisoryByCVE 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware on activity detected policy configured investigation rule Security alert network alert.
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    Advisory:
      type: object
      description: A PSIRT security advisory for a Palo Alto Networks product.
      properties:
        advisory_id:
          type: string
          description: Palo Alto Networks advisory identifier (e.g., PAN-SA-2024-0001).
          example: '234493'
        cve_id:
          type: string
          description: CVE identifier (e.g., CVE-2024-3400).
          example: '128548'
        title:
          type: string
          description: Advisory title summarizing the vulnerability.
          example: Corporate Agent 18
        description:
          type: string
          description: Detailed description of the vulnerability including impact and attack vector.
          example: Rule suspicious endpoint investigation firewall suspicious blocked configured.
        severity:
          type: string
          enum:
          - NONE
          - LOW
          - MEDIUM
          - HIGH
          - CRITICAL
          description: Severity rating based on CVSS v3.1 base score.
          example: CRITICAL
        cvss_score:
          type: number
          description: CVSS v3.1 base score (0.0 to 10.0).
          minimum: 0.0
          maximum: 10.0
          example: 7.06
        cvss_vector:
          type: string
          description: CVSS v3.1 vector string (e.g., CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
          example: example-cvss_vector
        cwe:
          type: string
          description: CWE identifier for the vulnerability class.
          example: example-cwe
        affected_products:
          type: array
          description: Products and version ranges affected by this vulnerability.
          items:
            $ref: '#/components/schemas/AffectedProduct'
          example:
          - product: example-product
            versions:
            - version: 3.0.0
              status: Unaffected
          - product: example-product
            versions:
            - version: 5.7.5
              status: Unaffected
            - version: 7.8.2
              status: Fixed
        fixed_versions:
          type: array
          items:
            type: string
          description: Product versions in which the vulnerability is fixed.
          example:
          - 1.5.8
          - 8.6.4
        workarounds:
          type: string
          description: Available workarounds or mitigations if a fix is not yet deployed.
          example: example-workarounds
        exploit_status:
          type: string
          enum:
          - None
          - Proof-of-Concept
          - Active
          description: Known exploit activity status.
          example: None
        published_date:
          type: string
          format: date-time
          description: Date and time when the advisory was first published.
          example: '2025-03-02T01:26:35Z'
        last_modified_date:
          type: string
          format: date-time
          description: Date and time of the most recent advisory update.
          example: '2025-08-23T12:10:49Z'
        references:
          type: array
          items:
            type: object
            properties:
              url:
                type: string
                format: uri
                description: Reference URL.
                example: https://vpn.example.com/5d2cff
              description:
                type: string
                description: Description of the referenced resource.
                example: Alert applied malware detected violation endpoint alert malware detected.
          description: External references and related advisories.
          example:
          - url: https://vpn.test-corp.net/3c1d96
            description: Traffic threat blocked activity incident monitoring violation Security Security.
    AffectedProduct:
      type: object
      properties:
        product:
          type: string
          description: Product name (e.g., PAN-OS, Cortex XDR Agent).
          example: example-product
        versions:
          type: array
          items:
            type: object
            properties:
              version:
                type: string
                description: Affected version or version range.
                example: 10.8.8
              status:
                type: string
                enum:
                - Affected
                - Unaffected
                - Fixed
                description: Vulnerability status for this version.
                example: Affected
          example:
          - version: 1.3.1
            status: Unaffected
          - version: 4.2.5
            status: Fixed
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the error type.
          example: example-error
        message:
          type: string
          description: Human-readable description of the error.
          example: Malware on activity detected policy configured investigation rule Security alert network alert.
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.