Palo Alto Networks

Palo Alto Networks Audits API

{'$ref': 'desc/audits/audits.md'}

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 96

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /api/v34.03/audits/access List Docker access audit events (v34.03) · Get Docker Access Audit Events #
Ask an LLM
“Which Docker commands were allowed or blocked on my hosts, according to the v34.03 audits API?”
“Can I filter v34.03 Docker access audits by user and hostname?”
Tell an agent
List v34.03 Docker access audit events on host {hostname} for user {user}.
Show v34.03 Docker access audits triggered by rule {ruleName} between {from} and {to}.
GET /api/v34.03/audits/access/download Download Docker access audit events (v34.03) · Download Docker Access Audit Events #
Ask an LLM
“Can I export Docker access audit events to a file using the v34.03 API?”
“Is there a way to download v34.03 Docker access audits for one cluster?”
Tell an agent
Download the v34.03 Docker access audit file for cluster {cluster}.
Export v34.03 Docker access audits from {from} to {to} as a download.
GET /api/v34.03/audits/admission List Kubernetes admission audit events (v34.03) · Get Admission Audit Events #
Ask an LLM
“Which admission control decisions were audited in a namespace under v34.03?”
“Can I find v34.03 admission audits tied to a MITRE attack technique?”
Tell an agent
List v34.03 admission audit events in namespace {namespace}.
Show v34.03 admission audits for operation {operation} on cluster {cluster}.
GET /api/v34.03/audits/admission/download Download admission audit events (v34.03) · Download Admission Audit Events #
Ask an LLM
“Can I download admission controller audits as a file from the v34.03 API?”
“Is it possible to export v34.03 admission audits for a single namespace?”
Tell an agent
Download v34.03 admission audit events for namespace {namespace}.
Export the v34.03 admission audit file between {from} and {to}.
GET /api/v34.03/audits/firewall/app/agentless List WAAS agentless audit events (v34.03) · Get WAAS Agentless Audit Events #
Ask an LLM
“What web attacks did WAAS agentless protection record under the v34.03 API?”
“Can I narrow v34.03 WAAS agentless audits to OWASP Top 10 findings or one country?”
Tell an agent
List v34.03 WAAS agentless audit events on host {hostname}.
Show v34.03 WAAS agentless audits from country {country} for URL path {urlPath}.
GET /api/v34.03/audits/firewall/app/agentless/download Download WAAS agentless audit events (v34.03) · Download WAAS Agentless Audit Events #
Ask an LLM
“Can I export WAAS agentless firewall audits to a file in v34.03?”
“Is there a download of v34.03 WAAS agentless events for one rule?”
Tell an agent
Download v34.03 WAAS agentless audits for rule {ruleName}.
Export the v34.03 WAAS agentless audit file for {from} to {to}.
GET /api/v34.03/audits/firewall/app/agentless/timeslice Chart WAAS agentless audits over time (v34.03) · Get WAAS Agentless Audit Events for a Timeframe #
Ask an LLM
“How are WAAS agentless audit events spread across a timeframe in v34.03?”
“Can I bucket v34.03 WAAS agentless events into a set number of time slices?”
Tell an agent
Split v34.03 WAAS agentless audits from {from} to {to} into {buckets} time buckets.
Get the v34.03 WAAS agentless audit timeline for host {hostname}.
GET /api/v34.03/audits/firewall/app/app-embedded List WAAS app-embedded audit events (v34.03) · Get WAAS App-embedded Audit Events #
Ask an LLM
“What attacks did app-embedded WAAS defenders block, per the v34.03 audits API?”
“Can I filter v34.03 app-embedded WAAS audits by app ID or effect?”
Tell an agent
List v34.03 WAAS app-embedded audit events for app {appID}.
Show v34.03 app-embedded WAAS audits with effect {effect} since {from}.
GET /api/v34.03/audits/firewall/app/app-embedded/download Download WAAS app-embedded audit events (v34.03) · Download WAAS App-embedded Audit Events #
Ask an LLM
“Can I download app-embedded WAAS audits as a file in v34.03?”
“Is there an export of v34.03 app-embedded WAAS events for one app?”
Tell an agent
Download v34.03 WAAS app-embedded audits for app {appID}.
Export the v34.03 app-embedded WAAS audit file from {from} to {to}.
GET /api/v34.03/audits/firewall/app/app-embedded/timeslice Chart WAAS app-embedded audits over time (v34.03) · Get WAAS App-embedded Audit Events for a Timeframe #
Ask an LLM
“How did app-embedded WAAS audit volume change over a timeframe in v34.03?”
“Can I get v34.03 app-embedded WAAS event counts per time bucket?”
Tell an agent
Bucket v34.03 WAAS app-embedded audits from {from} to {to} into {buckets} slices.
Get the v34.03 app-embedded WAAS audit timeline for app {appID}.
GET /api/v34.03/audits/firewall/app/container List WAAS container audit events (v34.03) · Get WAAS Container Audit Events #
Ask an LLM
“Which web attacks against my containers did WAAS log in v34.03?”
“Can I filter v34.03 WAAS container audits by image or container name?”
Tell an agent
List v34.03 WAAS container audit events for image {imageName}.
Show v34.03 WAAS container audits for container {containerName} on cluster {cluster}.
GET /api/v34.03/audits/firewall/app/container/download Download WAAS container audit events (v34.03) · Download WAAS Container Audit Events #
Ask an LLM
“Can I pull a v34.03 file export of the web application firewall events for my containers?”
“Is there a v34.03 download of WAAS container audits for one image?”
Tell an agent
Download v34.03 WAAS container audits for image {imageName}.
Export the v34.03 WAAS container audit file between {from} and {to}.
GET /api/v34.03/audits/firewall/app/container/timeslice Chart WAAS container audits over time (v34.03) · Get WAAS Container Audit Timeslice #
Ask an LLM
“How are WAAS container audit events distributed over time in v34.03?”
“Can I split v34.03 WAAS container events into time buckets for a chart?”
Tell an agent
Bucket v34.03 WAAS container audits from {from} to {to} into {buckets} slices.
Get the v34.03 WAAS container audit timeslice for image {imageName}.
GET /api/v34.03/audits/firewall/app/host List WAAS host audit events (v34.03) · Get WAAS Host Audit Events #
Ask an LLM
“What web attacks on host-based apps did WAAS record in v34.03?”
“Can I filter v34.03 WAAS host audits by the connecting IP or user agent?”
Tell an agent
List v34.03 WAAS audits for web apps running directly on host {hostname}.
Show v34.03 WAAS host audits from connecting IPs {connectingIPs}.
GET /api/v34.03/audits/firewall/app/host/download Download WAAS host audit events (v34.03) · Download WAAS Host Audit Events #
Ask an LLM
“Can I download WAAS host firewall audits as a file with v34.03?”
“Is there an export of v34.03 WAAS host audits for one hostname?”
Tell an agent
Download v34.03 WAAS host audits for host {hostname}.
Export the v34.03 WAAS host audit file from {from} to {to}.
GET /api/v34.03/audits/firewall/app/host/timeslice Chart WAAS host audits over time (v34.03) · Get WAAS Host Audit Timeslice #
Ask an LLM
“How did WAAS host audit activity trend across a period in v34.03?”
“Can I get v34.03 WAAS host audit counts grouped into time buckets?”
Tell an agent
Bucket v34.03 WAAS host audits from {from} to {to} into {buckets} slices.
Get the v34.03 WAAS host audit timeslice for host {hostname}.
GET /api/v34.03/audits/firewall/app/serverless List WAAS serverless audit events (v34.03) · Get WAAS Serverless Audit Events #
Ask an LLM
“Which attacks on my serverless functions did WAAS log in v34.03?”
“Can I filter v34.03 WAAS serverless audits by function or runtime?”
Tell an agent
List v34.03 WAAS serverless audit events for function {function}.
Show v34.03 WAAS serverless audits on runtime {runtime}.
GET /api/v34.03/audits/firewall/app/serverless/download Download WAAS serverless audit events (v34.03) · Download WAAS Serverless Audit Events #
Ask an LLM
“Can I get a v34.03 downloadable file of firewall events for my serverless functions?”
“Is there a v34.03 download of WAAS serverless events for one function?”
Tell an agent
Download v34.03 WAAS serverless audits for function {function}.
Export the v34.03 WAAS serverless audit file from {from} to {to}.
GET /api/v34.03/audits/firewall/app/serverless/timeslice Chart WAAS serverless audits over time (v34.03) · Get WAAS Serverless Audit Events for a Timeframe #
Ask an LLM
“How are WAAS serverless audit events spread over a timeframe in v34.03?”
“Can I bucket v34.03 WAAS serverless events by time for a trend view?”
Tell an agent
Bucket v34.03 WAAS serverless audits from {from} to {to} into {buckets} slices.
Get the v34.03 WAAS serverless audit timeline for function {function}.
GET /api/v34.03/audits/firewall/network/container List CNNS container network audits (v34.03) · Get CNNS Container Audit Events #
Ask an LLM
“Which container-to-container connections did cloud native network security flag in v34.03?”
“Can I see only blocked v34.03 CNNS container connections between two images?”
Tell an agent
List v34.03 CNNS container audits from image {srcImageName} to image {dstImageName}.
Show v34.03 CNNS container network audits with block filter {block}.
GET /api/v34.03/audits/firewall/network/container/download Download CNNS container network audits (v34.03) · Download CNNS Container Audit Events #
Ask an LLM
“Can I export CNNS container network audits as a file in v34.03?”
“Is there a v34.03 download of container network audits for one source image?”
Tell an agent
Download v34.03 CNNS container audits for source image {srcImageName}.
Export the v34.03 CNNS container audit file from {from} to {to}.
GET /api/v34.03/audits/firewall/network/host List CNNS host network audits (v34.03) · Get CNNS Host Audit Events #
Ask an LLM
“Which host-to-host connections did CNNS audit in v34.03?”
“Can I filter v34.03 CNNS host audits by source and destination hostnames?”
Tell an agent
List v34.03 CNNS host audits from {srcHostnames} to {dstHostnames}.
Show v34.03 CNNS host network audits since {from}.
GET /api/v34.03/audits/firewall/network/host/download Download CNNS host network audits (v34.03) · Download CNNS Host Audit Events #
Ask an LLM
“Can I download CNNS host network audits as a file in v34.03?”
“Is there a v34.03 export of host network audits for specific source hosts?”
Tell an agent
Download v34.03 CNNS host audits for source hosts {srcHostnames}.
Export the v34.03 CNNS host audit file between {from} and {to}.
GET /api/v34.03/audits/incidents List incident audit events (v34.03) · Get Incident Audit Events #
Ask an LLM
“What security incidents has Prisma Cloud Compute recorded, per the v34.03 API?”
“Can I list only unacknowledged v34.03 incidents in one category?”
Tell an agent
List v34.03 incidents in category {category} on host {hostname}.
Show v34.03 incident audits with acknowledged set to {acknowledged}.
PATCH /api/v34.03/audits/incidents/acknowledge/{id} Archive an incident (v34.03) · Archive an Incident Audit Event #
Ask an LLM
“How do I acknowledge and archive an incident through the v34.03 API?”
“Can I mark a v34.03 incident as acknowledged so it leaves the active list?”
Tell an agent
Archive incident {id} using the v34.03 API.
Set acknowledged to {acknowledged} on v34.03 incident {id}.
GET /api/v34.03/audits/incidents/download Download incident audit events (v34.03) · Download Incident Audit Events #
Ask an LLM
“Can I export incident audits to a file with the v34.03 API?”
“Is there a v34.03 download of incidents for one cluster?”
Tell an agent
Download v34.03 incident audits for cluster {cluster}.
Export the v34.03 incident file from {from} to {to}.
GET /api/v34.03/audits/kubernetes List Kubernetes audit events (v34.03) · Get Kubernetes Audit Events #
Ask an LLM
“Which Kubernetes API activity was flagged in the v34.03 audits?”
“Can I filter v34.03 Kubernetes audits by user or cluster?”
Tell an agent
List v34.03 Kubernetes audit events for user {user}.
Show v34.03 Kubernetes audits on cluster {cluster} since {from}.
GET /api/v34.03/audits/kubernetes/download Download Kubernetes audit events (v34.03) · Download Kubernetes Audit Events #
Ask an LLM
“Can I download Kubernetes audit events as a file in v34.03?”
“Is there a v34.03 export of Kubernetes audits for one cluster?”
Tell an agent
Download v34.03 Kubernetes audits for cluster {cluster}.
Export the v34.03 Kubernetes audit file from {from} to {to}.
GET /api/v34.03/audits/mgmt List management audit events (v34.03) · Get Management Audit Events #
Ask an LLM
“Who changed settings in the Console, according to the v34.03 management audits?”
“Can I see v34.03 management audit events for one admin username?”
Tell an agent
List v34.03 management audit events by user {username}.
Show v34.03 management audits of type {type} between {from} and {to}.
GET /api/v34.03/audits/mgmt/download Download management audit events (v34.03) · Download Management Audit Events #
Ask an LLM
“Can I export Console management audits to a file in v34.03?”
“Is there a v34.03 download of admin activity for one username?”
Tell an agent
Download v34.03 management audits for user {username}.
Export the v34.03 management audit file from {from} to {to}.
GET /api/v34.03/audits/mgmt/filters Get management audit filter values (v34.03) · Get Management Audit Event Filters #
Ask an LLM
“What filter values can I use when searching management audits in v34.03?”
“Which usernames and audit types appear as v34.03 management audit filters?”
Tell an agent
Get the v34.03 management audit filter options.
Show the v34.03 management audit filters available for type {type}.
GET /api/v34.03/audits/runtime/app-embedded List runtime app-embedded audit events (v34.03) · Get Runtime App-embedded Audit Events #
Ask an LLM
“What runtime alerts did app-embedded defenders raise in v34.03?”
“Can I filter v34.03 app-embedded runtime audits by attack type or process path?”
Tell an agent
List v34.03 runtime app-embedded audits for app {appID}.
Show v34.03 app-embedded runtime audits with attack type {attackType}.
GET /api/v34.03/audits/runtime/app-embedded/download Download runtime app-embedded audits (v34.03) · Download Runtime App-embedded Audit Events #
Ask an LLM
“Can I grab a v34.03 file of runtime (not WAAS) alerts from app-embedded defenders?”
“Is there a v34.03 export of runtime app-embedded events for one app?”
Tell an agent
Download v34.03 runtime app-embedded audits for app {appID}.
Export the v34.03 runtime app-embedded audit file from {from} to {to}.
GET /api/v34.03/audits/runtime/container List runtime container audit events (v34.03) · Get Runtime Container Audit Events #
Ask an LLM
“What suspicious process, network or file activity did runtime defense see in containers in v34.03?”
“Can I filter v34.03 container runtime audits by image and namespace?”
Tell an agent
List v34.03 runtime container audits for image {imageName} in namespace {namespace}.
Show v34.03 container runtime audits for container {container}.
GET /api/v34.03/audits/runtime/container/download Download runtime container audits (v34.03) · Download Runtime Container Audit Events #
Ask an LLM
“Can I export container runtime audits to a file in v34.03?”
“Is there a v34.03 download of runtime container events for one image?”
Tell an agent
Download v34.03 runtime container audits for image {imageName}.
Export the v34.03 runtime container audit file between {from} and {to}.
GET /api/v34.03/audits/runtime/container/timeslice Chart runtime container audits over time (v34.03) · Get Runtime Container Audit Events for a Timeframe #
Ask an LLM
“How did container runtime audit volume trend across a timeframe in v34.03?”
“Can I bucket v34.03 runtime container events into time slices?”
Tell an agent
Bucket v34.03 runtime container audits from {from} to {to} into {buckets} slices.
Get the v34.03 runtime container audit timeline for image {imageName}.
GET /api/v34.03/audits/runtime/file-integrity List file integrity audit events (v34.03) · Get Runtime File Integrity Audit Events #
Ask an LLM
“Which monitored files were changed on my hosts, per v34.03 file integrity audits?”
“Can I filter v34.03 file integrity events by path or event type?”
Tell an agent
List v34.03 file integrity audits on host {hostname} for path {path}.
Show v34.03 file integrity events of type {eventType}.
GET /api/v34.03/audits/runtime/file-integrity/download Download file integrity audit events (v34.03) · Download Runtime File Integrity Audit Events #
Ask an LLM
“Can I download file integrity monitoring audits as a file in v34.03?”
“Is there a v34.03 export of file integrity events for one host?”
Tell an agent
Download v34.03 file integrity audits for host {hostname}.
Export the v34.03 file integrity audit file from {from} to {to}.
GET /api/v34.03/audits/runtime/host List runtime host audit events (v34.03) · Get Runtime Host Audit Events #
Ask an LLM
“What runtime alerts did host defenders raise in the v34.03 audits?”
“Can I filter v34.03 host runtime audits by user or process path?”
Tell an agent
List v34.03 runtime host audits on host {hostname}.
Show v34.03 host runtime audits for process path {processPath} run by {user}.
GET /api/v34.03/audits/runtime/host/download Download runtime host audits (v34.03) · Download Runtime Host Audit Events #
Ask an LLM
“Can I export host runtime audits to a file in v34.03?”
“Is there a v34.03 download of runtime host events for one hostname?”
Tell an agent
Download v34.03 runtime host audits for host {hostname}.
Export the v34.03 runtime host audit file from {from} to {to}.
GET /api/v34.03/audits/runtime/host/timeslice Chart runtime host audits over time (v34.03) · Get Runtime Host Audit Events for a Timeframe #
Ask an LLM
“How are host runtime audit events distributed over time in v34.03?”
“Can I get v34.03 runtime host audit counts per time bucket?”
Tell an agent
Bucket v34.03 runtime host audits from {from} to {to} into {buckets} slices.
Get the v34.03 runtime host audit timeline for host {hostname}.
GET /api/v34.03/audits/runtime/log-inspection List log inspection audit events (v34.03) · Get Runtime Log Inspection Audit Events #
Ask an LLM
“Which log inspection rules matched lines in my host logs, per v34.03?”
“Can I filter v34.03 log inspection audits by log file?”
Tell an agent
List v34.03 log inspection audits for log file {logfile}.
Show v34.03 log inspection events on host {hostname}.
GET /api/v34.03/audits/runtime/log-inspection/download Download log inspection audit events (v34.03) · Download Runtime Log Inspection Audit Events #
Ask an LLM
“Can I download log inspection audits as a file in v34.03?”
“Is there a v34.03 export of log inspection events for one host?”
Tell an agent
Download v34.03 log inspection audits for host {hostname}.
Export the v34.03 log inspection audit file from {from} to {to}.
GET /api/v34.03/audits/runtime/serverless List runtime serverless audit events (v34.03) · Get Runtime Serverless Audit Events #
Ask an LLM
“What runtime alerts fired for my serverless functions in v34.03?”
“Can I filter v34.03 serverless runtime audits by function and effect?”
Tell an agent
List v34.03 runtime serverless audits for function {function}.
Show v34.03 serverless runtime audits with effect {effect} on runtime {runtime}.
GET /api/v34.03/audits/runtime/serverless/download Download runtime serverless audits (v34.03) · Download Serverless Audit Events #
Ask an LLM
“Can I export serverless runtime audits to a file in v34.03?”
“Is there a v34.03 file export of runtime defense alerts for one serverless function?”
Tell an agent
Download v34.03 runtime serverless audits for function {function}.
Export the v34.03 runtime serverless audit file from {from} to {to}.
GET /api/v34.03/audits/runtime/serverless/timeslice Chart runtime serverless audits over time (v34.03) · Get Runtime Serverless Audit Events for a Timeframe #
Ask an LLM
“How did serverless runtime audit activity trend over a timeframe in v34.03?”
“Can I split v34.03 runtime serverless events into time buckets?”
Tell an agent
Bucket v34.03 runtime serverless audits from {from} to {to} into {buckets} slices.
Get the v34.03 runtime serverless audit timeline for function {function}.
GET /api/v34.03/audits/trust List trusted image audit events (v34.03) · Get Trust Audit Events #
Ask an LLM
“Which untrusted images were alerted on or blocked, per the v34.03 trust audits?”
“Can I filter v34.03 trust audits by rule and effect?”
Tell an agent
List v34.03 trusted image audits for rule {ruleName}.
Show v34.03 trust audits with effect {effect}.
GET /api/v34.03/audits/trust/download Download trusted image audit events (v34.03) · Download Trust Audit Events #
Ask an LLM
“Can I download trusted image audits as a file in v34.03?”
“Is there a v34.03 export of trust audits for one rule?”
Tell an agent
Download v34.03 trust audits for rule {ruleName}.
Export the v34.03 trusted image audit file from {from} to {to}.
GET /api/v34.04/audits/access List Docker access audit events (v34.04) · Get Docker Access Audit Events #
Ask an LLM
“On the newer v34.04 audits API, which Docker commands did Defender allow or deny?”
“Does v34.04 let me show only allowed Docker access requests?”
Tell an agent
Get Docker access audits from v34.04 for cluster {cluster}.
Using v34.04, show Docker access audits where allow is {allow} for user {user}.
GET /api/v34.04/audits/access/download Download Docker access audit events (v34.04) · Download Docker Access Audit Events #
Ask an LLM
“Is there a v34.04 endpoint to save Docker access audits as a file?”
“With v34.04, can I export Docker access audits for a single host?”
Tell an agent
Save a v34.04 Docker access audit export for host {hostname}.
Using v34.04, download Docker access audits for rule {ruleName}.
GET /api/v34.04/audits/admission List Kubernetes admission audit events (v34.04) · Get Admission Audit Events #
Ask an LLM
“On v34.04, which requests did the admission controller audit in my clusters?”
“Does the v34.04 admission audit list filter by attack technique?”
Tell an agent
Get v34.04 admission audits tagged with attack techniques {attackTechniques}.
Using v34.04, show admission audit events on cluster {cluster}.
GET /api/v34.04/audits/admission/download Download admission audit events (v34.04) · Download Admission Audit Events #
Ask an LLM
“Is there a v34.04 way to save admission audits to a file?”
“With v34.04, can I export admission audits for one cluster?”
Tell an agent
Save a v34.04 admission audit export for cluster {cluster}.
Using v34.04, download admission audits for operation {operation}.
GET /api/v34.04/audits/firewall/app/agentless List WAAS agentless audit events (v34.04) · Get WAAS Agentless Audit Events #
Ask an LLM
“On v34.04, what attacks did agentless WAAS protection detect?”
“Does v34.04 let me filter WAAS agentless audits by OWASP API Top 10 category?”
Tell an agent
Get v34.04 WAAS agentless audits for request host {requestHost}.
Using v34.04, show WAAS agentless audits matching OWASP Top 10 {owaspTop10}.
GET /api/v34.04/audits/firewall/app/agentless/download Download WAAS agentless audit events (v34.04) · Download WAAS Agentless Audit Events #
Ask an LLM
“Is there a v34.04 endpoint to save WAAS agentless audits as a file?”
“With v34.04, can I export agentless WAAS events for one host?”
Tell an agent
Save a v34.04 WAAS agentless audit export for host {hostname}.
Using v34.04, download WAAS agentless audits from country {country}.
GET /api/v34.04/audits/firewall/app/agentless/timeslice Chart WAAS agentless audits over time (v34.04) · Get WAAS Agentless Audit Events for a Timeframe #
Ask an LLM
“On v34.04, how do agentless WAAS events break down across a time window?”
“Does v34.04 return WAAS agentless audit counts per time bucket?”
Tell an agent
Using v34.04, split WAAS agentless audits from {from} to {to} into {buckets} buckets.
Get a v34.04 WAAS agentless timeslice for rule {ruleName}.
GET /api/v34.04/audits/firewall/app/app-embedded List WAAS app-embedded audit events (v34.04) · Get WAAS App-embedded Audit Events #
Ask an LLM
“On v34.04, which attacks did app-embedded WAAS defenders catch?”
“Does v34.04 let me filter app-embedded WAAS audits by URL or HTTP method?”
Tell an agent
Get v34.04 WAAS app-embedded audits for URL {url}.
Using v34.04, show app-embedded WAAS audits for HTTP method {method}.
GET /api/v34.04/audits/firewall/app/app-embedded/download Download WAAS app-embedded audit events (v34.04) · Download WAAS App-embedded Audit Events #
Ask an LLM
“Is there a v34.04 way to save app-embedded WAAS audits to a file?”
“With v34.04, can I export app-embedded WAAS events for one rule?”
Tell an agent
Save a v34.04 WAAS app-embedded audit export for rule {ruleName}.
Using v34.04, download app-embedded WAAS audits on cluster {cluster}.
GET /api/v34.04/audits/firewall/app/app-embedded/timeslice Chart WAAS app-embedded audits over time (v34.04) · Get WAAS App-embedded Audit Events for a Timeframe #
Ask an LLM
“On v34.04, how do app-embedded WAAS events spread across a time window?”
“Does v34.04 give app-embedded WAAS audit counts per time bucket?”
Tell an agent
Using v34.04, split WAAS app-embedded audits from {from} to {to} into {buckets} buckets.
Get a v34.04 app-embedded WAAS timeslice for rule {ruleName}.
GET /api/v34.04/audits/firewall/app/container List WAAS container audit events (v34.04) · Get WAAS Container Audit Events #
Ask an LLM
“On v34.04, which web attacks did WAAS record against my containers?”
“Does v34.04 let me filter WAAS container audits by attack technique or protection type?”
Tell an agent
Get v34.04 WAAS container audits in namespace {ns}.
Using v34.04, show WAAS container audits for protection {protection}.
GET /api/v34.04/audits/firewall/app/container/download Download WAAS container audit events (v34.04) · Download WAAS Container Audit Events #
Ask an LLM
“Is there a v34.04 endpoint that saves container web firewall events as a file?”
“With v34.04, can I export WAAS container events for one container?”
Tell an agent
Save a v34.04 WAAS container audit export for container {containerName}.
Using v34.04, download WAAS container audits for rule {ruleName}.
GET /api/v34.04/audits/firewall/app/container/timeslice Chart WAAS container audits over time (v34.04) · Get WAAS Container Audit Timeslice #
Ask an LLM
“On v34.04, how do WAAS container events break down over a time window?”
“Does v34.04 return WAAS container audit counts in time buckets?”
Tell an agent
Using v34.04, split WAAS container audits from {from} to {to} into {buckets} buckets.
Get a v34.04 WAAS container timeslice for container {containerName}.
GET /api/v34.04/audits/firewall/app/host List WAAS host audit events (v34.04) · Get WAAS Host Audit Events #
Ask an LLM
“On v34.04, what web attacks did WAAS log for host-based apps?”
“Does v34.04 let me filter WAAS host audits by country or subnet?”
Tell an agent
Get v34.04 WAAS host audits from subnet {subnet}.
Using v34.04, show WAAS host audits for user agent {userAgentHeader}.
GET /api/v34.04/audits/firewall/app/host/download Download WAAS host audit events (v34.04) · Download WAAS Host Audit Events #
Ask an LLM
“Is there a v34.04 way to save WAAS host audits to a file?”
“With v34.04, can I export WAAS host events for one rule?”
Tell an agent
Save a v34.04 WAAS host audit export for rule {ruleName}.
Using v34.04, download WAAS host audits for host {hostname}.
GET /api/v34.04/audits/firewall/app/host/timeslice Chart WAAS host audits over time (v34.04) · Get WAAS Host Audit Timeslice #
Ask an LLM
“On v34.04, how do WAAS host events spread across a time window?”
“Does v34.04 give WAAS host audit counts per time bucket?”
Tell an agent
Using v34.04, split WAAS host audits from {from} to {to} into {buckets} buckets.
Get a v34.04 WAAS host timeslice for rule {ruleName}.
GET /api/v34.04/audits/firewall/app/serverless List WAAS serverless audit events (v34.04) · Get WAAS Serverless Audit Events #
Ask an LLM
“On v34.04, which attacks against serverless functions did WAAS record?”
“Does v34.04 let me filter WAAS serverless audits by URL path or effect?”
Tell an agent
Get v34.04 WAAS serverless audits for URL path {urlPath}.
Using v34.04, show WAAS serverless audits with effect {effect}.
GET /api/v34.04/audits/firewall/app/serverless/download Download WAAS serverless audit events (v34.04) · Download WAAS Serverless Audit Events #
Ask an LLM
“Can v34.04 give me a saved file of web firewall hits on serverless functions?”
“With v34.04, can I export WAAS serverless events for one runtime?”
Tell an agent
Save a v34.04 WAAS serverless audit export for runtime {runtime}.
Using v34.04, download WAAS serverless audits for function {function}.
GET /api/v34.04/audits/firewall/app/serverless/timeslice Chart WAAS serverless audits over time (v34.04) · Get WAAS Serverless Audit Events for a Timeframe #
Ask an LLM
“On v34.04, what does the over-time pattern of WAAS attacks on my serverless functions look like?”
“Does v34.04 return WAAS serverless audit counts per time bucket?”
Tell an agent
Using v34.04, split WAAS serverless audits from {from} to {to} into {buckets} buckets.
Get a v34.04 WAAS serverless timeslice for runtime {runtime}.
GET /api/v34.04/audits/firewall/network/container List CNNS container network audits (v34.04) · Get CNNS Container Audit Events #
Ask an LLM
“On v34.04, which container network connections did CNNS audit or block?”
“Does v34.04 let me see container network audits for one destination image?”
Tell an agent
Get v34.04 CNNS container audits for destination image {dstImageName}.
Using v34.04, show CNNS container network audits between {from} and {to}.
GET /api/v34.04/audits/firewall/network/container/download Download CNNS container network audits (v34.04) · Download CNNS Container Audit Events #
Ask an LLM
“Is there a v34.04 way to save CNNS container network audits to a file?”
“With v34.04, can I export only blocked container network connections?”
Tell an agent
Save a v34.04 CNNS container audit export with block filter {block}.
Using v34.04, download CNNS container audits for destination image {dstImageName}.
GET /api/v34.04/audits/firewall/network/host List CNNS host network audits (v34.04) · Get CNNS Host Audit Events #
Ask an LLM
“On v34.04, which host network connections did CNNS record?”
“Does v34.04 let me list host network audits for one destination host?”
Tell an agent
Get v34.04 CNNS host audits for destination hosts {dstHostnames}.
Using v34.04, show CNNS host network audits between {from} and {to}.
GET /api/v34.04/audits/firewall/network/host/download Download CNNS host network audits (v34.04) · Download CNNS Host Audit Events #
Ask an LLM
“Is there a v34.04 endpoint to save CNNS host network audits as a file?”
“With v34.04, can I export host network audits for specific destination hosts?”
Tell an agent
Save a v34.04 CNNS host audit export for destination hosts {dstHostnames}.
Using v34.04, download CNNS host audits since {from}.
GET /api/v34.04/audits/incidents List incident audit events (v34.04) · Get Incident Audit Events #
Ask an LLM
“On v34.04, which incidents were raised for a given container or function?”
“Does v34.04 let me filter incidents by type or custom rule name?”
Tell an agent
Get v34.04 incidents for container {containerID}.
Using v34.04, show incidents of type {type} from custom rule {customRuleName}.
PATCH /api/v34.04/audits/incidents/acknowledge/{id} Archive an incident (v34.04) · Archive an Incident Audit Event #
Ask an LLM
“On v34.04, can I archive an incident once it has been investigated?”
“Which v34.04 call flags an incident as acknowledged by its ID?”
Tell an agent
Using v34.04, archive incident {id}.
Acknowledge v34.04 incident {id} with acknowledged {acknowledged}.
GET /api/v34.04/audits/incidents/download Download incident audit events (v34.04) · Download Incident Audit Events #
Ask an LLM
“Is there a v34.04 way to save incidents to a file?”
“With v34.04, can I export incidents in one category?”
Tell an agent
Save a v34.04 incident export for category {category}.
Using v34.04, download incidents for host {hostname}.
GET /api/v34.04/audits/kubernetes List Kubernetes audit events (v34.04) · Get Kubernetes Audit Events #
Ask an LLM
“On v34.04, which Kubernetes audit events matched my rules?”
“Does v34.04 let me filter Kubernetes audits by attack technique?”
Tell an agent
Get v34.04 Kubernetes audits with attack techniques {attackTechniques}.
Using v34.04, show Kubernetes audit events for user {user}.
GET /api/v34.04/audits/kubernetes/download Download Kubernetes audit events (v34.04) · Download Kubernetes Audit Events #
Ask an LLM
“Is there a v34.04 endpoint to save Kubernetes audits as a file?”
“With v34.04, can I export Kubernetes audits for one user?”
Tell an agent
Save a v34.04 Kubernetes audit export for user {user}.
Using v34.04, download Kubernetes audits on cluster {cluster}.
GET /api/v34.04/audits/mgmt List management audit events (v34.04) · Get Management Audit Events #
Ask an LLM
“On v34.04, what administrative changes were made in the Console?”
“Does v34.04 let me filter management audits by audit type?”
Tell an agent
Get v34.04 management audits of type {type}.
Using v34.04, show admin activity by {username} since {from}.
GET /api/v34.04/audits/mgmt/download Download management audit events (v34.04) · Download Management Audit Events #
Ask an LLM
“Is there a v34.04 way to save management audits to a file?”
“With v34.04, can I export management audits of one type?”
Tell an agent
Save a v34.04 management audit export for type {type}.
Using v34.04, download management audits for user {username}.
GET /api/v34.04/audits/mgmt/filters Get management audit filter values (v34.04) · Get Management Audit Event Filters #
Ask an LLM
“On v34.04, which values can I filter management audits on?”
“Does v34.04 list the usernames available for filtering management audits?”
Tell an agent
Using v34.04, list the management audit filter values.
Get v34.04 management audit filter options for user {username}.
GET /api/v34.04/audits/runtime/app-embedded List runtime app-embedded audit events (v34.04) · Get Runtime App-embedded Audit Events #
Ask an LLM
“On v34.04, which runtime events did app-embedded defenders report?”
“Does v34.04 let me filter app-embedded runtime audits by effect?”
Tell an agent
Get v34.04 runtime app-embedded audits with effect {effect}.
Using v34.04, show app-embedded runtime audits for request {requestID}.
GET /api/v34.04/audits/runtime/app-embedded/download Download runtime app-embedded audits (v34.04) · Download Runtime App-embedded Audit Events #
Ask an LLM
“Is there a v34.04 endpoint to save app-embedded runtime audits as a file?”
“With v34.04, can I export runtime app-embedded events by attack type?”
Tell an agent
Save a v34.04 runtime app-embedded audit export for attack type {attackType}.
Using v34.04, download runtime app-embedded audits for app {appID}.
GET /api/v34.04/audits/runtime/container List runtime container audit events (v34.04) · Get Runtime Container Audit Events #
Ask an LLM
“On v34.04, what runtime anomalies were detected in my containers?”
“Does v34.04 let me filter container runtime audits by attack type or rule?”
Tell an agent
Get v34.04 runtime container audits with attack type {attackType}.
Using v34.04, show container runtime audits for rule {ruleName} on cluster {cluster}.
GET /api/v34.04/audits/runtime/container/download Download runtime container audits (v34.04) · Download Runtime Container Audit Events #
Ask an LLM
“Is there a v34.04 way to save container runtime audits to a file?”
“With v34.04, can I export runtime container events for one namespace?”
Tell an agent
Save a v34.04 runtime container audit export for namespace {namespace}.
Using v34.04, download runtime container audits for image {imageName}.
GET /api/v34.04/audits/runtime/container/timeslice Chart runtime container audits over time (v34.04) · Get Runtime Container Audit Events for a Timeframe #
Ask an LLM
“On v34.04, how do container runtime events spread across a time window?”
“Does v34.04 return runtime container audit counts per time bucket?”
Tell an agent
Using v34.04, split runtime container audits from {from} to {to} into {buckets} buckets.
Get a v34.04 runtime container timeslice for namespace {namespace}.
GET /api/v34.04/audits/runtime/file-integrity List file integrity audit events (v34.04) · Get Runtime File Integrity Audit Events #
Ask an LLM
“On v34.04, which file changes did file integrity monitoring catch?”
“Does v34.04 let me filter file integrity audits by cluster?”
Tell an agent
Get v34.04 file integrity audits for path {path}.
Using v34.04, show file integrity events on cluster {cluster}.
GET /api/v34.04/audits/runtime/file-integrity/download Download file integrity audit events (v34.04) · Download Runtime File Integrity Audit Events #
Ask an LLM
“Is there a v34.04 endpoint to save file integrity audits as a file?”
“With v34.04, can I export file integrity events for one path?”
Tell an agent
Save a v34.04 file integrity audit export for path {path}.
Using v34.04, download file integrity audits of event type {eventType}.
GET /api/v34.04/audits/runtime/host List runtime host audit events (v34.04) · Get Runtime Host Audit Events #
Ask an LLM
“On v34.04, what runtime anomalies did host defenders detect?”
“Does v34.04 let me filter host runtime audits by attack type or effect?”
Tell an agent
Get v34.04 runtime host audits with attack type {attackType}.
Using v34.04, show host runtime audits with effect {effect} for rule {ruleName}.
GET /api/v34.04/audits/runtime/host/download Download runtime host audits (v34.04) · Download Runtime Host Audit Events #
Ask an LLM
“Is there a v34.04 way to save host runtime audits to a file?”
“With v34.04, can I export runtime host events for one rule?”
Tell an agent
Save a v34.04 runtime host audit export for rule {ruleName}.
Using v34.04, download runtime host audits for host {hostname}.
GET /api/v34.04/audits/runtime/host/timeslice Chart runtime host audits over time (v34.04) · Get Runtime Host Audit Events for a Timeframe #
Ask an LLM
“On v34.04, how do host runtime events break down across a time window?”
“Does v34.04 give runtime host audit counts in time buckets?”
Tell an agent
Using v34.04, split runtime host audits from {from} to {to} into {buckets} buckets.
Get a v34.04 runtime host timeslice for rule {ruleName}.
GET /api/v34.04/audits/runtime/log-inspection List log inspection audit events (v34.04) · Get Runtime Log Inspection Audit Events #
Ask an LLM
“On v34.04, which log lines triggered log inspection audits?”
“Does v34.04 let me filter log inspection audits by cluster?”
Tell an agent
Get v34.04 log inspection audits for log file {logfile}.
Using v34.04, show log inspection events on cluster {cluster}.
GET /api/v34.04/audits/runtime/log-inspection/download Download log inspection audit events (v34.04) · Download Runtime Log Inspection Audit Events #
Ask an LLM
“Is there a v34.04 endpoint to save log inspection audits as a file?”
“With v34.04, can I export log inspection events for one log file?”
Tell an agent
Save a v34.04 log inspection audit export for log file {logfile}.
Using v34.04, download log inspection audits for host {hostname}.
GET /api/v34.04/audits/runtime/serverless List runtime serverless audit events (v34.04) · Get Runtime Serverless Audit Events #
Ask an LLM
“On v34.04, what runtime events were raised for serverless functions?”
“Does v34.04 let me filter serverless runtime audits by attack type or request ID?”
Tell an agent
Get v34.04 runtime serverless audits with attack type {attackType}.
Using v34.04, show serverless runtime audits for request {requestID}.
GET /api/v34.04/audits/runtime/serverless/download Download runtime serverless audits (v34.04) · Download Serverless Audit Events #
Ask an LLM
“Is there a v34.04 way to save serverless runtime audits to a file?”
“With v34.04, can I export runtime defense alerts (not WAAS) for one serverless runtime?”
Tell an agent
Save a v34.04 export of runtime defense alerts for serverless runtime {runtime}.
Using v34.04, download runtime serverless audits for function {function}.
GET /api/v34.04/audits/runtime/serverless/timeslice Chart runtime serverless audits over time (v34.04) · Get Runtime Serverless Audit Events for a Timeframe #
Ask an LLM
“On v34.04, how do runtime defense alerts on serverless functions trend over a time window?”
“Does v34.04 return runtime serverless audit counts per time bucket?”
Tell an agent
Using v34.04, split runtime serverless audits from {from} to {to} into {buckets} buckets.
Chart v34.04 runtime defense alerts for function {function} across time buckets.
GET /api/v34.04/audits/trust List trusted image audit events (v34.04) · Get Trust Audit Events #
Ask an LLM
“On v34.04, which images violated my trusted image rules?”
“Does v34.04 let me list trust audits within a time range?”
Tell an agent
Get v34.04 trusted image audits with effect {effect}.
Using v34.04, show trust audits between {from} and {to}.
GET /api/v34.04/audits/trust/download Download trusted image audit events (v34.04) · Download Trust Audit Events #
Ask an LLM
“Is there a v34.04 endpoint to save trusted image audits as a file?”
“With v34.04, can I export only blocked trust audits?”
Tell an agent
Save a v34.04 trust audit export with effect {effect}.
Using v34.04, download trusted image audits for rule {ruleName}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-audits-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-audits-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-audits-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks Audits API
  x-description-source: desc/intro.md
  version: '1.0'
  description: 'Operations tagged Audits across 2 of this provider''s published API definitions: palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json, palo-alto-compute-openapi-34-04-145-sh-openapi.json. Each path carries the servers of the definition it was published in.'
tags:


# --- truncated at 32 KB (719 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-audits-api-openapi.yml