Palo Alto Networks

Palo Alto Networks Custom Rules API

{'$ref': 'desc/custom-rules/custom-rules.md'}

GitHub OpenAPI

Operations 6

GET /api/v34.03/custom-rules Get Custom Rules #
DELETE /api/v34.03/custom-rules/{id} Delete a Custom Rule #
PUT /api/v34.03/custom-rules/{id} Update a Custom Rule #
GET /api/v34.04/custom-rules Get Custom Rules #
DELETE /api/v34.04/custom-rules/{id} Delete a Custom Rule #
PUT /api/v34.04/custom-rules/{id} Update a Custom Rule #

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-custom-rules-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks-custom-rules-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-custom-rules-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks Custom Rules API
  x-description-source: desc/intro.md
  version: '1.0'
  description: 'Operations tagged Custom-Rules across 4 of this provider''s published API definitions: palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json, palo-alto-compute-openapi-34-04-145-sh-openapi.json, palo-alto-cwpp-34-03-openapi-34-03-138-saas-openapi.json, palo-alto-cwpp-openapi-34-04-145-saas-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: PATH_TO_CONSOLE
tags:
- name: Custom-Rules
  description: Custom-Rules. 3 operations in this definition.
  x-description-source: desc/custom-rules/custom-rules.md
paths:
  /api/v34.03/custom-rules:
    get:
      description: 'Get Custom Rules. GET /api/v34.03/custom-rules on the Custom-Rules API. Documented responses: 200.'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/-_customrules.Rule'
          description: ''
        default:
          description: ''
      tags:
      - Custom-Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: get-custom-rules
      summary: Get Custom Rules
      x-description-source: desc/custom-rules/get.md
  /api/v34.03/custom-rules/{id}:
    delete:
      description: 'Delete a Custom Rule. DELETE /api/v34.03/custom-rules/{id} on the Custom-Rules API. Takes 1 path parameter. Documented responses: 200.'
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Custom-Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: delete-custom-rules-id
      summary: Delete a Custom Rule
      x-description-source: desc/custom-rules/id_delete.md
    put:
      description: 'Update a Custom Rule. PUT /api/v34.03/custom-rules/{id} on the Custom-Rules API. Takes 1 path parameter, an optional request body. Documented responses: 200.'
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/customrules.Rule'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Custom-Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: put-custom-rules-id
      summary: Update a Custom Rule
      x-description-source: desc/custom-rules/id_put.md
  /api/v34.04/custom-rules:
    get:
      description: 'Get Custom Rules. GET /api/v34.04/custom-rules on the Custom-Rules API. Documented responses: 200.'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/-_customrules.Rule'
          description: ''
        default:
          description: ''
      tags:
      - Custom-Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: get-custom-rules
      summary: Get Custom Rules
      x-description-source: desc/custom-rules/get.md
  /api/v34.04/custom-rules/{id}:
    delete:
      description: 'Delete a Custom Rule. DELETE /api/v34.04/custom-rules/{id} on the Custom-Rules API. Takes 1 path parameter. Documented responses: 200.'
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Custom-Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: delete-custom-rules-id
      summary: Delete a Custom Rule
      x-description-source: desc/custom-rules/id_delete.md
    put:
      description: 'Update a Custom Rule. PUT /api/v34.04/custom-rules/{id} on the Custom-Rules API. Takes 1 path parameter, an optional request body. Documented responses: 200.'
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/customrules.Rule'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Custom-Rules
      x-prisma-cloud-target-env:
        permission: policyCustomRules
      operationId: put-custom-rules-id
      summary: Update a Custom Rule
      x-description-source: desc/custom-rules/id_put.md
components:
  schemas:
    customrules.Type:
      description: Type is the type of the custom rule
      enum:
      - - processes
        - filesystem
        - network-outgoing
        - kubernetes-audit
        - waas-request
        - waas-response
      type: string
    -_customrules.Rule:
      items:
        $ref: '#/components/schemas/customrules.Rule'
      type: array
    mitre.Technique:
      description: Technique is the MITRE framework attack technique
      enum:
      - - exploitationForPrivilegeEscalation
        - exploitPublicFacingApplication
        - applicationExploitRCE
        - networkServiceScanning
        - endpointDenialOfService
        - exfiltrationGeneral
        - systemNetworkConfigurationDiscovery
        - unsecuredCredentials
        - credentialDumping
        - systemInformationDiscovery
        - systemNetworkConnectionDiscovery
        - systemUserDiscovery
        - accountDiscovery
        - cloudInstanceMetadataAPI
        - accessKubeletMainAPI
        - queryKubeletReadonlyAPI
        - accessKubernetesAPIServer
        - softwareDeploymentTools
        - ingressToolTransfer
        - lateralToolTransfer
        - commandAndControlGeneral
        - resourceHijacking
        - manInTheMiddle
        - nativeBinaryExecution
        - foreignBinaryExecution
        - createAccount
        - accountManipulation
        - abuseElevationControlMechanisms
        - supplyChainCompromise
        - obfuscatedFiles
        - hijackExecutionFlow
        - impairDefences
        - scheduledTaskJob
        - exploitationOfRemoteServices
        - eventTriggeredExecution
        - accountAccessRemoval
        - privilegedContainer
        - writableVolumes
        - execIntoContainer
        - softwareDiscovery
        - createContainer
        - kubernetesSecrets
        - fileAndDirectoryDiscovery
        - masquerading
        - webShell
        - compileAfterDelivery
      type: string
    customrules.Rule:
      description: Rule represents a custom rule
      properties:
        _id:
          description: 'Rule ID. Must be unique.

            '
          type: integer
        attackTechniques:
          description: 'List of attack techniques.

            '
          items:
            $ref: '#/components/schemas/mitre.Technique'
          type: array
        description:
          description: 'Description of the rule.

            '
          type: string
        message:
          description: 'Macro that is printed as part of the audit/incident message.

            '
          type: string
        minVersion:
          description: 'Minimum version required to support the rule.

            '
          type: string
        modified:
          description: 'Datetime when the rule was created or last modified.

            '
          format: int64
          type: integer
        name:
          description: 'Name of the rule.

            '
          type: string
        owner:
          description: 'User who created or modified the rule.

            '
          type: string
        script:
          description: 'Custom script.

            '
          type: string
        type:
          $ref: '#/components/schemas/customrules.Type'
        vulnIDs:
          $ref: '#/components/schemas/customrules.VulnIDs'
      type: object
    string:
      type: string
    customrules.VulnIDs:
      description: VulnIDs is the list of vulnerability IDs
      items:
        $ref: '#/components/schemas/string'
      type: array
x-refined-from:
- palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json
- palo-alto-compute-openapi-34-04-145-sh-openapi.json
- palo-alto-cwpp-34-03-openapi-34-03-138-saas-openapi.json
- palo-alto-cwpp-openapi-34-04-145-saas-openapi.json