Palo Alto Networks

Palo Alto Networks Anomalies API

Set the enterprise level settings to build standard training models for anomaly detection, alert disposition, and some other global settings such as the timeout before the user is locked out for inactivity and user attribution for alerts. Also, exclude trusted IP addresses when conducting tests for PCI compliance or penetration testing on your network. Any addresses included in this list do not generate alerts against the Prisma Cloud Anomaly Policies that detect unusual network activity such as the policies that detect internal port scan and port sweep activity, which are enabled by default.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 10

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /anomalies/trusted_list List anomaly trusted list entries · Get Anomaly Trusted List #
Ask an LLM
“Which IPs or resources are on my anomaly trusted list?”
“Can I see every entry excluded from anomaly alerts?”
Tell an agent
List all anomaly trusted list entries with token {auth}.
Show my anomaly trusted list using auth token {auth}.
POST /anomalies/trusted_list Add entries to the anomaly trusted list · Add Entries to Anomaly Trusted List #
Ask an LLM
“How do I stop anomaly policies alerting on a known IP?”
“Can I scope a new trusted list entry to one account or VPC?”
Tell an agent
Add trusted list {name} of type {trustedListType} for policies {applicablePolicies} with entries {trustedListEntries}.
Trust entries {trustedListEntries} in VPC {vpc} under list {name}.
GET /anomalies/trusted_list/{id} Get an anomaly trusted list entry · Get Anomaly Trusted List Entry #
Ask an LLM
“What does a particular anomaly trusted list entry contain?”
“Which policies does one trusted list entry apply to?”
Tell an agent
Get anomaly trusted list entry {id}.
Show the policies covered by trusted list entry {id}.
POST /anomalies/trusted_list/{id} Update an anomaly trusted list entry · Update Anomaly Trusted List Entry #
Ask an LLM
“How do I change the entries in an existing anomaly trusted list?”
“Can I update the reason recorded on a trusted list entry?”
Tell an agent
Update trusted list {id} with entries {trustedListEntries}.
Change the description of trusted list {id} to {description}.
DELETE /anomalies/trusted_list/{id} Delete an anomaly trusted list entry · Delete Anomaly Trusted List Entry #
Ask an LLM
“How do I remove something from the anomaly trusted list?”
“Will deleting a trusted list entry make anomaly alerts fire again for it?”
Tell an agent destructive · confirm first
Delete anomaly trusted list entry {id}.
Remove trusted list {id} so anomalies alert on it again.
GET /anomalies/settings/{policyid} Get anomaly settings for a policy · Get Anomaly Settings #
Ask an LLM
“What alert disposition and training threshold does one anomaly policy use?”
“How sensitive is a specific anomaly policy set to be?”
Tell an agent
Get anomaly settings for policy {policyid}.
Show the training model threshold for anomaly policy {policyid}.
POST /anomalies/settings/{policyid} Update anomaly settings for a policy · Update Anomaly Settings #
Ask an LLM
“How do I make an anomaly policy less noisy?”
“Can I change the training model threshold on an anomaly policy?”
Tell an agent
Set alert disposition {alertDisposition} on anomaly policy {policyid}.
Change the training threshold of policy {policyid} to {trainingModelThreshold}.
GET /anomalies/trusted_list/types List trusted list types · List Allowed Trusted List Types #
Ask an LLM
“What kinds of anomaly trusted lists can I create?”
“Which trusted list types are available for anomalies?”
Tell an agent
List the allowed anomaly trusted list types using token {auth}.
Show trusted list types available, authenticating with {auth}.
GET /anomalies/settings Get all anomaly settings by type · Get All Anomaly Settings #
Ask an LLM
“What are the settings for all my network anomaly policies?”
“Can I see anomaly settings for every policy of one anomaly type?”
Tell an agent
Get anomaly settings for every policy of type {type}.
List all {type} anomaly policy settings.
GET /anomalies/policies List policies for a trusted list type · List Policies for Trusted List Type #
Ask an LLM
“Which anomaly policies can a given trusted list type apply to?”
“What policies should I pick for an IP trusted list?”
Tell an agent
List anomaly policies available for trusted list type {trustedListType}.
Show which policies accept trusted list type {trustedListType}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-anomalies-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-anomalies-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-anomalies-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact: {}
  description: 'Access Keys are a secure way to enable programmatic access to the Prisma Cloud API. By default, only

    the System Admin has API access and can enable API access for other administrators. If you have API access,

    you can create up to two access keys. Create an access key for a limited time period and regenerate your API

    keys periodically to minimize exposure and follow security best practices.'
  title: Prisma Cloud Access Keys API Overview Anomalies API
  version: Latest
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
tags:
- name: Anomalies
  description: 'Set the enterprise level settings to build standard training models for anomaly detection, alert disposition,

    and some other global settings such as the timeout before the user is locked out for inactivity and user

    attribution for alerts.'
paths:
  /anomalies/trusted_list:
    get:
      tags:
      - Anomalies
      summary: Get Anomaly Trusted List
      description: Returns all entries in the Anomaly Trusted List.
      operationId: getAllWhitelistEntries
      parameters:
      - name: x-redlock-auth
        in: header
        description: Authorize using Authentication token
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AnomaliesTrustedListSummaryBean'
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AnomaliesTrustedListSummaryBean'
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AnomaliesTrustedListSummaryBean'
      security:
      - x-redlock-auth: []
    post:
      tags:
      - Anomalies
      summary: Add Entries to Anomaly Trusted List
      description: Adds one or more entries to the Anomaly Trusted List.
      operationId: addToTrustedList
      parameters:
      - name: x-redlock-auth
        in: header
        description: Authorize using Authentication token
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnomaliesTrustedListSummary'
        required: true
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
      security:
      - x-redlock-auth: []
  /anomalies/trusted_list/{id}:
    get:
      tags:
      - Anomalies
      summary: Get Anomaly Trusted List Entry
      description: Returns the entry with the specified ID from the Anomaly Trusted List.
      operationId: getWhitelistEntryById
      parameters:
      - name: x-redlock-auth
        in: header
        description: Authorize using Authentication token
        required: true
        schema:
          type: string
      - name: id
        in: path
        description: Anomaly Trusted List identifier
        required: true
        schema:
          type: integer
          format: int32
        example: 205
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: string
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: string
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: string
      security:
      - x-redlock-auth: []
    post:
      tags:
      - Anomalies
      summary: Update Anomaly Trusted List Entry
      description: Modifies an existing entry in the Anomaly Trusted List.
      operationId: updateWhitelist
      parameters:
      - name: x-redlock-auth
        in: header
        description: Authorize using Authentication token
        required: true
        schema:
          type: string
      - name: id
        in: path
        description: Anomaly Trusted List identifier
        required: true
        schema:
          type: integer
          format: int32
        example: 205
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnomaliesTrustedListSummary'
        required: true
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
      security:
      - x-redlock-auth: []
    delete:
      tags:
      - Anomalies
      summary: Delete Anomaly Trusted List Entry
      description: Deletes the entry with the given ID from the Anomaly Trusted List.
      operationId: deleteFromTrustedList
      parameters:
      - name: x-redlock-auth
        in: header
        description: Authorize using Authentication token
        required: true
        schema:
          type: string
      - name: id
        in: path
        description: Anomaly Trusted List identifier
        required: true
        schema:
          type: integer
          format: int32
        example: 205
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
      security:
      - x-redlock-auth: []
  /anomalies/settings/{policyid}:
    get:
      tags:
      - Anomalies
      summary: Get Anomaly Settings
      description: Returns anomaly settings for the specified policy ID.
      operationId: getAnomaliesSettings
      parameters:
      - name: x-redlock-auth
        in: header
        description: Authorize using Authentication token
        required: true
        schema:
          type: string
      - name: policyid
        in: path
        description: Policy ID
        required: true
        schema:
          type: string
        example: 6b4614ef-2347-abe3-7522-445982e4816f
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AnomaliesSettings'
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AnomaliesSettings'
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AnomaliesSettings'
      security:
      - x-redlock-auth: []
    post:
      tags:
      - Anomalies
      summary: Update Anomaly Settings
      description: Updates anomaly settings for the policy with the specified ID.
      operationId: updateSettings
      parameters:
      - name: x-redlock-auth
        in: header
        description: Authorize using Authentication token
        required: true
        schema:
          type: string
      - name: policyid
        in: path
        description: Policy ID
        required: true
        schema:
          type: string
        example: 6b4614ef-2347-abe3-7522-445982e4816f
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnomaliesSettings'
        required: true
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
      security:
      - x-redlock-auth: []
  /anomalies/trusted_list/types:
    get:
      tags:
      - Anomalies
      summary: List Allowed Trusted List Types
      description: Returns the available trusted list types.
      operationId: getAllowedTrustedListTypes
      parameters:
      - name: x-redlock-auth
        in: header
        description: Authorize using Authentication token
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesTrustedListTypeEntry'
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesTrustedListTypeEntry'
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesTrustedListTypeEntry'
      security:
      - x-redlock-auth: []
  /anomalies/settings:
    get:
      tags:
      - Anomalies
      summary: Get All Anomaly Settings
      description: Returns all anomaly settings. The response object is a list of policy IDs, and anomaly settings are returned with each policy ID.
      operationId: getAllAnomaliesSettings
      parameters:
      - name: x-redlock-auth
        in: header
        description: Authorize using Authentication token
        required: true
        schema:
          type: string
      - name: type
        in: query
        description: Specify type of Anomaly whose settings are needed
        required: true
        schema:
          type: string
        example: Network, UEBA, DNS
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesSettings'
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesSettings'
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesSettings'
      security:
      - x-redlock-auth: []
  /anomalies/policies:
    get:
      tags:
      - Anomalies
      summary: List Policies for Trusted List Type
      description: Returns a list of available policies for a specific trusted list type.
      operationId: get-policies-anomalies
      parameters:
      - name: x-redlock-auth
        in: header
        description: Authorize using Authentication token
        required: true
        schema:
          type: string
      - name: trustedListType
        in: query
        description: Trusted list type
        required: true
        schema:
          type: string
        example: ip, resource, image, tag, service, port, subject, domain, protocol
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  type: string
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  type: string
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  type: string
      security:
      - x-redlock-auth: []
components:
  schemas:
    AnomaliesTrustedListSummaryBean:
      type: object
      properties:
        id:
          type: integer
          description: Anomalies trusted list ID
          format: int32
        customerID:
          type: integer
          description: Customer ID
          format: int32
        name:
          type: string
          description: Anomaly name
        description:
          type: string
          description: Anomaly description
        createdBy:
          type: string
          description: Created by
        createdOn:
          type: integer
          description: creation timestamp
          format: int64
        modifiedBy:
          type: string
          description: Modified by
        modifiedOn:
          type: integer
          description: Modification timestamp
          format: int64
        modifiedRoleId:
          type: string
          description: Role ID of user who last modified trusted list
        modifiedRoleTypeId:
          type: integer
          description: Role type ID of user who last modified trusted list
          format: int32
        createdRoleId:
          type: string
          description: Role ID of user who created trusted list
        createdRoleTypeId:
          type: integer
          description: Role type ID of user who created trusted list
          format: int32
        applicablePolicies:
          type: array
          description: List of applicable policies
          items:
            type: string
            description: List of applicable policies
        trustedListType:
          type: string
          description: Trusted list type
        accountID:
          type: string
          description: Account ID
        accountName:
          type: string
          description: Account name
        vpc:
          type: string
          description: Virtual private cloud
        trustedListEntries:
          type: array
          description: List of network anomalies in the trusted list
          items:
            $ref: '#/components/schemas/NetworkAnomaliesTrustedListEntry'
    NetworkAnomaliesTrustedListEntry:
      type: object
      properties:
        ipCIDR:
          type: string
          description: IP CIDR block
        resourceID:
          type: string
          description: Resource ID
        imageID:
          type: string
          description: Image ID
        tagKey:
          type: string
          description: Tag key
        tagValue:
          type: string
          description: Tag value
        service:
          type: string
          description: Service
        port:
          type: string
          description: Port
        subject:
          type: string
          description: Subject Name
        domain:
          type: string
          description: Domain
        protocol:
          type: string
          description: Protocol
      description: List of network anomalies in the trusted list
    AnomaliesTrustedListTypeEntry:
      type: object
      properties:
        name:
          type: string
          description: Trusted list type name
        description:
          type: string
          description: Trusted list type description
        applicableCategories:
          type: array
          description: List of trusted list type applicable categories
          items:
            type: string
            description: List of trusted list type applicable categories
    AnomaliesTrustedListSummary:
      required:
      - applicablePolicies
      - name
      - trustedListEntries
      - trustedListType
      type: object
      properties:
        name:
          type: string
          description: Name of the trusted list
        description:
          type: string
          description: Reason for trusted listing
        applicablePolicies:
          type: array
          description: Applicable Policies
          items:
            type: string
            description: Applicable Policies
        trustedListType:
          type: string
          description: Trusted list type
          enum:
          - ip, resource, image, tag, service, port, subject, domain, protocol
        accountID:
          type: string
          description: Account ID. Default is "any".
          default: any
        vpc:
          type: string
          description: VPC. Default is "any".
          default: any
        trustedListEntries:
          type: array
          description: Trusted list entries
          items:
            $ref: '#/components/schemas/AnomaliesTrustedListEntry'
      description: Model for Anomaly Trusted List Request
    AnomaliesTrustedListEntry:
      type: object
      properties:
        ipCIDR:
          type: string
          description: IP CIDR Block
        resourceID:
          type: string
          description: Resource ID
        imageID:
          type: string
          description: Image ID
        tagKey:
          type: string
          description: Tag key
        tagValue:
          type: string
          description: Tag value
        service:
          type: string
          description: Service
        port:
          type: string
          description: Port
        subject:
          type: string
          description: Subject name
        domain:
          type: string
          description: Domain
        protocol:
          type: string
          description: Protocol
      description: Trusted list entries
    AnomaliesSettings:
      type: object
      properties:
        alertDisposition:
          type: string
          description: Alert Disposition Setting
          enum:
          - Aggressive, Moderate, Conservative
        trainingModelThreshold:
          type: string
          description: Training Model Threshold
          enum:
          - Low, Medium, High
        policyName:
          type: string
          description: Policy name
        policyDescription:
          type: string
          description: Policy description
        alertDispositionDescription:
          type: object
          additionalProperties:
            type: string
            description: Alert disposition description
          description: Alert disposition description
        trainingModelDescription:
          type: object
          additionalProperties:
            type: string
            description: Training model description
          description: Training model description
      description: Model for Anomaly Settings Request
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey