Palo Alto Networks

Palo Alto Networks Anomalies API

Set the enterprise level settings to build standard training models for anomaly detection, alert disposition, and some other global settings such as the timeout before the user is locked out for inactivity and user attribution for alerts. Also, exclude trusted IP addresses when conducting tests for PCI compliance or penetration testing on your network. Any addresses included in this list do not generate alerts against the Prisma Cloud Anomaly Policies that detect unusual network activity such as the policies that detect internal port scan and port sweep activity, which are enabled by default.

GitHub OpenAPI

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-anomalies-api-openapi.yml

OpenAPI Specification

palo-alto-networks-anomalies-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks Anomalies API
  version: Latest
  contact: {}
  description: 'Operations tagged Anomalies across 2 of this provider''s published API definitions: palo-alto-cspm-anomaliesmicroservice-openapi.json, palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- name: Anomalies
  description: "Set the enterprise level settings to build standard training models for anomaly detection, alert disposition, \nand some other global settings such as the timeout before the user is locked out for inactivity and user \nattribution for alerts.\n Also, exclude trusted IP addresses when conducting tests for PCI compliance or penetration testing on your network. \nAny addresses included in this list do not generate alerts against the Prisma Cloud Anomaly Policies that \ndetect unusual network activity such as the policies that detect internal port scan and port sweep activity, which are enabled by default.\n"
paths:
  /anomalies/trusted_list:
    get:
      tags:
      - Anomalies
      summary: Get Anomaly Trusted List
      description: Returns all entries in the Anomaly Trusted List.
      operationId: getAllWhitelistEntries
      parameters: []
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AnomaliesTrustedListSummaryBean'
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AnomaliesTrustedListSummaryBean'
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AnomaliesTrustedListSummaryBean'
      security:
      - x-redlock-auth: []
    post:
      tags:
      - Anomalies
      summary: Add Entries to Anomaly Trusted List
      description: Adds one or more entries to the Anomaly Trusted List.
      operationId: addToTrustedList
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnomaliesTrustedListSummary'
        required: true
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /anomalies/trusted_list/{id}:
    get:
      tags:
      - Anomalies
      summary: Get Anomaly Trusted List Entry
      description: Returns the entry with the specified ID from the Anomaly Trusted List.
      operationId: getWhitelistEntryById
      parameters:
      - name: id
        in: path
        description: Anomaly Trusted List identifier
        required: true
        schema:
          type: integer
          format: int32
        example: 205
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: string
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: string
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: string
      security:
      - x-redlock-auth: []
    post:
      tags:
      - Anomalies
      summary: Update Anomaly Trusted List Entry
      description: Modifies an existing entry in the Anomaly Trusted List.
      operationId: updateWhitelist
      parameters:
      - name: id
        in: path
        description: Anomaly Trusted List identifier
        required: true
        schema:
          type: integer
          format: int32
        example: 205
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnomaliesTrustedListSummary'
        required: true
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
      security:
      - x-redlock-auth: []
    delete:
      tags:
      - Anomalies
      summary: Delete Anomaly Trusted List Entry
      description: Deletes the entry with the given ID from the Anomaly Trusted List.
      operationId: deleteFromTrustedList
      parameters:
      - name: id
        in: path
        description: Anomaly Trusted List identifier
        required: true
        schema:
          type: integer
          format: int32
        example: 205
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /anomalies/settings/{policyid}:
    get:
      tags:
      - Anomalies
      summary: Get Anomaly Settings
      description: Returns anomaly settings for the specified policy ID.
      operationId: getAnomaliesSettings
      parameters:
      - name: policyid
        in: path
        description: Policy ID
        required: true
        schema:
          type: string
        example: 6b4614ef-2347-abe3-7522-445982e4816f
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AnomaliesSettings'
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AnomaliesSettings'
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AnomaliesSettings'
      security:
      - x-redlock-auth: []
    post:
      tags:
      - Anomalies
      summary: Update Anomaly Settings
      description: Updates anomaly settings for the policy with the specified ID.
      operationId: updateSettings
      parameters:
      - name: policyid
        in: path
        description: Policy ID
        required: true
        schema:
          type: string
        example: 6b4614ef-2347-abe3-7522-445982e4816f
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnomaliesSettings'
        required: true
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: boolean
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /anomalies/trusted_list/types:
    get:
      tags:
      - Anomalies
      summary: List Allowed Trusted List Types
      description: Returns the available trusted list types.
      operationId: getAllowedTrustedListTypes
      parameters: []
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesTrustedListTypeEntry'
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesTrustedListTypeEntry'
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesTrustedListTypeEntry'
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /anomalies/settings:
    get:
      tags:
      - Anomalies
      summary: Get All Anomaly Settings
      description: Returns all anomaly settings. The response object is a list of policy IDs, and anomaly settings are returned with each policy ID.
      operationId: getAllAnomaliesSettings
      parameters:
      - name: type
        in: query
        description: Specify type of Anomaly whose settings are needed
        required: true
        schema:
          type: string
        example: Network, UEBA, DNS
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesSettings'
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesSettings'
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/AnomaliesSettings'
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /anomalies/policies:
    get:
      tags:
      - Anomalies
      summary: List Policies for Trusted List Type
      description: Returns a list of available policies for a specific trusted list type.
      operationId: get-policies-anomalies
      parameters:
      - name: trustedListType
        in: query
        description: Trusted list type
        required: true
        schema:
          type: string
        example: ip, resource, image, tag, service, port, subject, domain, protocol
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  type: string
        '400':
          description: missing_required_parameter / invalid_parameter_value / internal_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  type: string
        '403':
          description: permission_error
          content:
            application/json; charset=UTF-8:
              schema:
                type: object
                additionalProperties:
                  type: string
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
components:
  schemas:
    AnomaliesTrustedListSummaryBean:
      type: object
      properties:
        id:
          type: integer
          description: Anomalies trusted list ID
          format: int32
        customerID:
          type: integer
          description: Customer ID
          format: int32
        name:
          type: string
          description: Anomaly name
        description:
          type: string
          description: Anomaly description
        createdBy:
          type: string
          description: Created by
        createdOn:
          type: integer
          description: creation timestamp
          format: int64
        modifiedBy:
          type: string
          description: Modified by
        modifiedOn:
          type: integer
          description: Modification timestamp
          format: int64
        modifiedRoleId:
          type: string
          description: Role ID of user who last modified trusted list
        modifiedRoleTypeId:
          type: integer
          description: Role type ID of user who last modified trusted list
          format: int32
        createdRoleId:
          type: string
          description: Role ID of user who created trusted list
        createdRoleTypeId:
          type: integer
          description: Role type ID of user who created trusted list
          format: int32
        applicablePolicies:
          type: array
          description: List of applicable policies
          items:
            type: string
            description: List of applicable policies
        trustedListType:
          type: string
          description: Trusted list type
        accountID:
          type: string
          description: Account ID
        accountName:
          type: string
          description: Account name
        vpc:
          type: string
          description: Virtual private cloud
        trustedListEntries:
          type: array
          description: List of network anomalies in the trusted list
          items:
            $ref: '#/components/schemas/NetworkAnomaliesTrustedListEntry'
    AnomaliesTrustedListSummary:
      required:
      - applicablePolicies
      - name
      - trustedListEntries
      - trustedListType
      type: object
      properties:
        name:
          type: string
          description: Name of the trusted list
        description:
          type: string
          description: Reason for trusted listing
        applicablePolicies:
          type: array
          description: Applicable Policies
          items:
            type: string
            description: Applicable Policies
        trustedListType:
          type: string
          description: Trusted list type
          enum:
          - ip, resource, image, tag, service, port, subject, domain, protocol
        accountID:
          type: string
          description: Account ID. Default is "any".
          default: any
        vpc:
          type: string
          description: VPC. Default is "any".
          default: any
        trustedListEntries:
          type: array
          description: Trusted list entries
          items:
            $ref: '#/components/schemas/AnomaliesTrustedListEntry'
      description: Model for Anomaly Trusted List Request
    AnomaliesSettings:
      type: object
      properties:
        alertDisposition:
          type: string
          description: Alert Disposition Setting
          enum:
          - Aggressive, Moderate, Conservative
        trainingModelThreshold:
          type: string
          description: Training Model Threshold
          enum:
          - Low, Medium, High
        policyName:
          type: string
          description: Policy name
        policyDescription:
          type: string
          description: Policy description
        alertDispositionDescription:
          type: object
          additionalProperties:
            type: string
            description: Alert disposition description
          description: Alert disposition description
        trainingModelDescription:
          type: object
          additionalProperties:
            type: string
            description: Training model description
          description: Training model description
      description: Model for Anomaly Settings Request
    AnomaliesTrustedListEntry:
      type: object
      properties:
        ipCIDR:
          type: string
          description: IP CIDR Block
        resourceID:
          type: string
          description: Resource ID
        imageID:
          type: string
          description: Image ID
        tagKey:
          type: string
          description: Tag key
        tagValue:
          type: string
          description: Tag value
        service:
          type: string
          description: Service
        port:
          type: string
          description: Port
        subject:
          type: string
          description: Subject name
        domain:
          type: string
          description: Domain
        protocol:
          type: string
          description: Protocol
      description: Trusted list entries
    NetworkAnomaliesTrustedListEntry:
      type: object
      properties:
        ipCIDR:
          type: string
          description: IP CIDR block
        resourceID:
          type: string
          description: Resource ID
        imageID:
          type: string
          description: Image ID
        tagKey:
          type: string
          description: Tag key
        tagValue:
          type: string
          description: Tag value
        service:
          type: string
          description: Service
        port:
          type: string
          description: Port
        subject:
          type: string
          description: Subject Name
        domain:
          type: string
          description: Domain
        protocol:
          type: string
          description: Protocol
      description: List of network anomalies in the trusted list
    AnomaliesTrustedListTypeEntry:
      type: object
      properties:
        name:
          type: string
          description: Trusted list type name
        description:
          type: string
          description: Trusted list type description
        applicableCategories:
          type: array
          description: List of trusted list type applicable categories
          items:
            type: string
            description: List of trusted list type applicable categories
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
x-refined-from:
- palo-alto-cspm-anomaliesmicroservice-openapi.json
- palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json