Palo Alto Networks Custom Rules API

{'$ref': 'desc/custom-rules/custom-rules.md'}

Documentation GitHub OpenAPI

Business capability

Threat Detection & Response Management BC-620.30

Operations 6

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /api/v34.03/custom-rules List custom runtime rules (v34.03) · Get Custom Rules #

Ask an LLM

“Which custom rules are defined, according to the older v34.03 API?”

“Can I pull all custom runtime rules through v34.03?”

Tell an agent

List custom rules using API v34.03.

Fetch every custom rule from the v34.03 endpoint.

DELETE /api/v34.03/custom-rules/{id} Delete a custom rule (v34.03) · Delete a Custom Rule #

Ask an LLM

“How do I delete a custom rule through the v34.03 API?”

“Can I remove a custom runtime rule by id on v34.03?”

Tell an agent destructive · confirm first

Delete custom rule {id} using API v34.03.

Remove v34.03 custom rule {id}.

PUT /api/v34.03/custom-rules/{id} Update a custom rule (v34.03) · Update a Custom Rule #

Ask an LLM

“How do I change a custom rule's script with the v34.03 API?”

“Can I map vulnerability IDs to a custom rule on v34.03?”

Tell an agent

Update custom rule {id} via v34.03 with script {script}.

Using v34.03, set the alert message of custom rule {id} to {message}.

GET /api/v34.04/custom-rules List custom runtime rules (v34.04) · Get Custom Rules #

Ask an LLM

“What custom rules exist in Prisma Cloud Compute on the current v34.04 API?”

“Can I see the scripts and attack techniques of my custom rules via v34.04?”

Tell an agent

List custom rules using API v34.04.

Show all v34.04 custom rules with their scripts.

DELETE /api/v34.04/custom-rules/{id} Delete a custom rule (v34.04) · Delete a Custom Rule #

Ask an LLM

“How do I delete a custom rule using the v34.04 API?”

“Can I permanently remove a v34.04 custom rule?”

Tell an agent destructive · confirm first

Delete custom rule {id} using API v34.04.

Permanently remove v34.04 custom rule {id}.

PUT /api/v34.04/custom-rules/{id} Update a custom rule (v34.04) · Update a Custom Rule #

Ask an LLM

“How do I edit a custom rule on the v34.04 API?”

“Can I tag a custom rule with MITRE attack techniques in v34.04?”

Tell an agent

Update v34.04 custom rule {id} with script {script}.

Set attack techniques {attackTechniques} on custom rule {id} via v34.04.

Specifications

⚙

OpenAPI

https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-custom-rules-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-custom-rules-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Palo Alto Networks Custom Rules API
  x-description-source: desc/intro.md
  version: '1.0'
  description: 'Operations tagged Custom-Rules across 2 of this provider''s published API definitions: palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json, palo-alto-compute-openapi-34-04-145-sh-openapi.json. Each path carries the servers of the definition it was published in.'
tags:
- name: Custom Rules
  description: Custom-Rules. 3 operations in this definition.
  x-description-source: desc/custom-rules/custom-rules.md
paths:
  /api/v34.03/custom-rules:
    get:
      description: 'Get Custom Rules. GET /api/v34.03/custom-rules on the Custom-Rules API. Documented responses: 200.'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/-_customrules.Rule'
          description: ''
        default:
          description: ''
      tags:
      - Custom Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: get-custom-rules
      summary: Get Custom Rules
      x-description-source: desc/custom-rules/get.md
  /api/v34.03/custom-rules/{id}:
    delete:
      description: 'Delete a Custom Rule. DELETE /api/v34.03/custom-rules/{id} on the Custom-Rules API. Takes 1 path parameter. Documented responses: 200.'
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Custom Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: delete-custom-rules-id
      summary: Delete a Custom Rule
      x-description-source: desc/custom-rules/id_delete.md
    put:
      description: 'Update a Custom Rule. PUT /api/v34.03/custom-rules/{id} on the Custom-Rules API. Takes 1 path parameter, an optional request body. Documented responses: 200.'
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/customrules.Rule'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Custom Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: put-custom-rules-id
      summary: Update a Custom Rule
      x-description-source: desc/custom-rules/id_put.md
  /api/v34.04/custom-rules:
    get:
      description: 'Get Custom Rules. GET /api/v34.04/custom-rules on the Custom-Rules API. Documented responses: 200.'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/-_customrules.Rule'
          description: ''
        default:
          description: ''
      tags:
      - Custom Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: getApiV3404CustomRules
      summary: Get Custom Rules
      x-description-source: desc/custom-rules/get.md
      x-operation-id-source: normalized
      x-operation-id-original: get-custom-rules
  /api/v34.04/custom-rules/{id}:
    delete:
      description: 'Delete a Custom Rule. DELETE /api/v34.04/custom-rules/{id} on the Custom-Rules API. Takes 1 path parameter. Documented responses: 200.'
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Custom Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: deleteApiV3404CustomRulesById
      summary: Delete a Custom Rule
      x-description-source: desc/custom-rules/id_delete.md
      x-operation-id-source: normalized
      x-operation-id-original: delete-custom-rules-id
    put:
      description: 'Update a Custom Rule. PUT /api/v34.04/custom-rules/{id} on the Custom-Rules API. Takes 1 path parameter, an optional request body. Documented responses: 200.'
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/customrules.Rule'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Custom Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: putApiV3404CustomRulesById
      summary: Update a Custom Rule
      x-description-source: desc/custom-rules/id_put.md
      x-operation-id-source: normalized
      x-operation-id-original: put-custom-rules-id
components:
  schemas:
    customrules.Type:
      description: Type is the type of the custom rule
      enum:
      - - processes
        - filesystem
        - network-outgoing
        - kubernetes-audit
        - waas-request
        - waas-response
      type: string
    string:
      type: string
    customrules.Rule:
      description: Rule represents a custom rule
      properties:
        _id:
          description: 'Rule ID. Must be unique.

            '
          type: integer
        attackTechniques:
          description: 'List of attack techniques.

            '
          items:
            $ref: '#/components/schemas/mitre.Technique'
          type: array
        description:
          description: 'Description of the rule.

            '
          type: string
        message:
          description: 'Macro that is printed as part of the audit/incident message.

            '
          type: string
        minVersion:
          description: 'Minimum version required to support the rule.

            '
          type: string
        modified:
          description: 'Datetime when the rule was created or last modified.

            '
          format: int64
          type: integer
        name:
          description: 'Name of the rule.

            '
          type: string
        owner:
          description: 'User who created or modified the rule.

            '
          type: string
        script:
          description: 'Custom script.

            '
          type: string
        type:
          $ref: '#/components/schemas/customrules.Type'
        vulnIDs:
          $ref: '#/components/schemas/customrules.VulnIDs'
      type: object
    -_customrules.Rule:
      items:
        $ref: '#/components/schemas/customrules.Rule'
      type: array
    customrules.VulnIDs:
      description: VulnIDs is the list of vulnerability IDs
      items:
        $ref: '#/components/schemas/string'
      type: array
    mitre.Technique:
      description: Technique is the MITRE framework attack technique
      enum:
      - - exploitationForPrivilegeEscalation
        - exploitPublicFacingApplication
        - applicationExploitRCE
        - networkServiceScanning
        - endpointDenialOfService
        - exfiltrationGeneral
        - systemNetworkConfigurationDiscovery
        - unsecuredCredentials
        - credentialDumping
        - systemInformationDiscovery
        - systemNetworkConnectionDiscovery
        - systemUserDiscovery
        - accountDiscovery
        - cloudInstanceMetadataAPI
        - accessKubeletMainAPI
        - queryKubeletReadonlyAPI
        - accessKubernetesAPIServer
        - softwareDeploymentTools
        - ingressToolTransfer
        - lateralToolTransfer
        - commandAndControlGeneral
        - resourceHijacking
        - manInTheMiddle
        - nativeBinaryExecution
        - foreignBinaryExecution
        - createAccount
        - accountManipulation
        - abuseElevationControlMechanisms
        - supplyChainCompromise
        - obfuscatedFiles
        - hijackExecutionFlow
        - impairDefences
        - scheduledTaskJob
        - exploitationOfRemoteServices
        - eventTriggeredExecution
        - accountAccessRemoval
        - privilegedContainer
        - writableVolumes
        - execIntoContainer
        - softwareDiscovery
        - createContainer
        - kubernetesSecrets
        - fileAndDirectoryDiscovery
        - masquerading
        - webShell
        - compileAfterDelivery
      type: string
x-refined-from:
- palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json
- palo-alto-compute-openapi-34-04-145-sh-openapi.json