Palo Alto Networks Data Resource API API
Data Resource
OpenAPI Specification
openapi: 3.2.0
info:
contact:
email: support@paloaltonetworks.com
description: 'This Open API spec file represents the APIs available for
[Palo Alto Networks Aggregate Monitoring](https://docs.paloaltonetworks.com/NEED-URL) APIs.
After you have configured your tenants, these APIs can be used to perform aggregated monitoring queries for information about applications, threats, URLs, and licenses across all your tenants of a Prisma Access or Prisma SD-WAN instance.
These APIs use the common SASE authentication mechanism and base URL. See the
[Prisma SASE API Get Started](https://pan.dev/sase/docs/getstarted) guide for more information.
This Open API spec file was created on October 01, 2024. To check for a more recent version of this file, see
[Aggregate Monitoring APIs on pan.dev](https://pan.dev/sase/api/mt-monitor/).
© 2024 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at
[https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html)
All other marks mentioned herein may be trademarks of their respective companies.
'
title: Aggreagate Monitoring Data Resource API API
version: '1.0'
servers:
- url: https://api.sase.paloaltonetworks.com
tags:
- description: "Data Resource \n"
name: Data Resource API
paths:
/mt/monitor/v1/agg/alerts:
post:
description: "Retrieve an aggregated count of alerts across tenants. \n"
operationId: post-mt-monitor-v1-agg-alerts
parameters:
- description: 'Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned.
'
example: tenant
in: query
name: agg_by
schema:
type: string
- description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region. \n"
example: americas
in: header
name: X-PANW-Region
schema:
type: string
requestBody:
content:
application/json:
examples:
Alerts Count By Tenant:
value:
filter:
operator: AND
rules:
- operator: in
property: domain
values:
- External
- external
- operator: last_n_days
property: updated_time
values:
- 7
properties:
- property: sub_tenant_id
- alias: count
function: count
property: alert_id
Alerts Distribution By Severity:
value:
filter:
operator: AND
rules:
- operator: in
property: domain
values:
- External
- external
- operator: last_n_days
property: updated_time
values:
- 7
properties:
- property: severity
- alias: count
function: count
property: alert_id
sort:
order: desc
Alerts Trend:
value:
filter:
operator: AND
rules:
- operator: in
property: domain
values:
- External
- external
- operator: last_n_days
property: updated_time
values:
- 7
histogram:
enableEmptyInterval: false
property: updated_time
range: day
value: '1'
properties:
- alias: count
function: count
property: alert_id
sort:
order: desc
schema:
$ref: '#/components/schemas/RequestBody_Resource'
responses:
'200':
content:
application/json:
examples:
Alerts Count By Tenant:
value:
- count: 10
sub_tenant_id: <sub_tenant_id>
Alerts Distribution By Severity:
value:
- count: 3
severity: <severity>
Alerts Trend:
value:
- count: 1
updated_time: 1657238400000
- count: 1
updated_time: 1657411200000
description: Success
'400':
description: Bad Request
'500':
description: Server Error
security:
- Bearer: []
summary: List alert count
tags:
- Data Resource API
/mt/monitor/v1/agg/alerts/list:
post:
description: "Retrieve an aggregated list of alert counts by source across tenants. \n"
operationId: post-mt-monitor-v1-agg-alerts-list
parameters:
- description: 'Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned.
'
example: tenant
in: query
name: agg_by
schema:
type: string
- description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region. \n"
example: americas
in: header
name: X-PANW-Region
schema:
type: string
requestBody:
content:
application/json:
examples:
Alerts Count By Source:
value:
filter:
operator: AND
rules:
- operator: in
property: domain
values:
- External
- external
- operator: last_n_days
property: event_time
values:
- 7
properties:
- property: total_count
- property: mu_count
- property: rn_count
- property: sc_count
schema:
$ref: '#/components/schemas/RequestBody_Alert'
responses:
'200':
content:
application/json:
examples:
Alerts Count By Source:
value:
- mu_count: 10
rn_count: 10
sc_count: 10
total_count: 10
description: Success
'400':
description: Bad Request
'500':
description: Server Error
security:
- Bearer: []
summary: List alerts by source
tags:
- Data Resource API
/mt/monitor/v1/agg/applicationUsage:
post:
description: "Retrieve a list of application usage by application type. \n"
operationId: post-mt-monitor-v1-agg-applicationusage
parameters:
- description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
example: tenant
in: query
name: agg_by
schema:
type: string
- description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region. \n"
example: americas
in: header
name: X-PANW-Region
schema:
type: string
requestBody:
content:
application/json:
examples:
Risky Application Usage Trend:
value:
filter:
operator: AND
rules:
- operator: last_n_days
property: event_time
values:
- 7
- rule: app_risky
histogram:
enableEmptyInterval: false
property: event_time
range: day
value: '1'
properties:
- alias: total_bytes_usage
function: sum
property: total_bytes
Top Application Categories by Data Usage:
value:
count: 5
filter:
operator: AND
rules:
- operator: is_not_null
property: app_sub_category
- operator: not_equals
property: app_sub_category
values:
- ''
- operator: last_n_days
property: event_time
values:
- 30
properties:
- alias: app_usage
function: sum
property: total_bytes
sort:
order: desc
- property: app_sub_category
Top Apps by Data:
value:
filter:
operator: AND
rules:
- operator: last_n_days
property: event_time
values:
- 30
- operator: is_not_null
property: app
- operator: not_equals
property: app
values:
- ''
properties:
- property: app
- alias: unique_count
function: distinct_count
property: app
- alias: total_bytes_usage
function: sum
property: total_bytes
schema:
$ref: '#/components/schemas/RequestBody_Resource'
responses:
'200':
content:
application/json:
examples:
Risky Application Usage Trend:
value:
- event_time: <time in ms>
total_bytes_usage: 100
Top Application Categories by Data Usage:
value:
- app_sub_category: <app-sub-category>
app_usage: 100
Top Apps by Data:
value:
- app: <app-name>
total_bytes_usage: 10
unique_count: 1
description: Success
'400':
description: Bad Request
'500':
description: Server Error
security:
- Bearer: []
summary: List application usage by type
tags:
- Data Resource API
/mt/monitor/v1/agg/applications:
post:
description: "Retrieve an aggregated count of applications across tenants. \n"
operationId: post-mt-monitor-v1-agg-applications
parameters:
- description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
example: tenant
in: query
name: agg_by
schema:
type: string
- description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region. \n"
example: americas
in: header
name: X-PANW-Region
schema:
type: string
requestBody:
content:
application/json:
examples:
Security Rules and Risky Apps:
value:
count: 4
filter:
operator: AND
rules:
- rule: app_risky
- operator: not_equals
property: rule_matched
values:
- ''
- operator: is_not_null
property: rule_matched
- rule: unblocked
- operator: last_n_days
property: event_time
values:
- 30
properties:
- property: sub_tenant_id
- alias: count
function: sum
property: app_count
sort:
order: desc
- alias: rule_name
property: rule_matched
Top Applications By Connection:
value:
count: 5
filter:
operator: AND
rules:
- operator: is_not_null
property: app_category
- operator: not_equals
property: app_category
values:
- ''
- operator: last_n_days
property: event_time
values:
- 30
properties:
- alias: total_sessions
function: count
property: session_id
sort:
order: desc
- property: app_category
- property: sub_tenant_id
Top Users Accessing Risky Apps:
value:
count: 4
filter:
operator: AND
rules:
- operator: not_equals
property: source_user_info_name
values:
- ''
- operator: is_not_null
property: source_user_info_name
- rule: app_risky
- operator: last_n_days
property: event_time
values:
- 30
properties:
- alias: count
function: sum
property: app_count
sort:
order: desc
- alias: user_name
property: source_user_info_name
- property: sub_tenant_id
schema:
$ref: '#/components/schemas/RequestBody_Resource'
responses:
'200':
content:
application/json:
examples:
Security Rules and Risky Apps:
value:
- count: 100
rule_name: <rule-name>
sub_tenant_id: <sub-tenant-id>
Top Applications By Connection:
value:
- app_category: <app-category>
sub_tenant_id: <sub-tenant-id>
total_sessions: 100
Top Users Accessing Risky Apps:
value:
- count: 12
sub_tenant_id: <sub-tenant-id>
user_name: <user-name>
description: Success
'400':
description: Bad Request
'500':
description: Server Error
security:
- Bearer: []
summary: List application count
tags:
- Data Resource API
/mt/monitor/v1/agg/applications/list:
post:
description: "Retrieve an aggregated list of applications across tenants. \n"
operationId: post-mt-monitor-v1-agg-applications-list
parameters:
- description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
example: tenant
in: query
name: agg_by
schema:
type: string
- description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region. \n"
example: americas
in: header
name: X-PANW-Region
schema:
type: string
requestBody:
content:
application/json:
examples:
Applications List:
value:
filter:
operator: AND
rules:
- operator: last_n_days
property: event_time
values:
- 7
properties:
- property: sub_tenant_id
- property: unique_total_apps
- property: risk_of_app_count
- property: blocked_app_count
schema:
$ref: '#/components/schemas/RequestBody_Application'
responses:
'200':
content:
application/json:
examples:
Applications List:
value:
- blocked_app_count: 10
risk_of_app_count: '3'
sub_tenant_id: '1234'
unique_total_apps: '2'
description: Success
'400':
description: Bad Request
'500':
description: Server Error
security:
- Bearer: []
summary: List applications
tags:
- Data Resource API
/mt/monitor/v1/agg/applications/source:
post:
description: "Retrieve an aggregated count of applications by source across tenants, such as: remote networks, mobile users, or proxy nodes. \n"
operationId: post-mt-monitor-v1-agg-applications-source
parameters:
- description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
example: tenant
in: query
name: agg_by
schema:
type: string
- description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region. \n"
example: americas
in: header
name: X-PANW-Region
schema:
type: string
requestBody:
content:
application/json:
examples:
Risky Application Count by Source:
value:
filter:
operator: AND
rules:
- operator: last_n_days
property: event_time
values:
- 7
properties:
- property: total_app_count
- property: total_app_remote_network
- property: total_app_mobile_users
- property: total_app_proxy_nodes
Risky Application Count by Source per Tenant:
value:
filter:
operator: AND
rules:
- operator: last_n_days
property: event_time
values:
- 7
properties:
- property: sub_tenant_id
- property: total_app_count
- property: total_app_remote_network
- property: total_app_mobile_users
- property: total_app_proxy_nodes
schema:
$ref: '#/components/schemas/RequestBody_AppSrc'
responses:
'200':
content:
application/json:
examples:
Risky Application Count by Source:
value:
- total_app_count: 10
total_app_mobile_users: 10
total_app_proxy_nodes: 10
total_app_remote_network: 10
Risky Application Count by Source per Tenant:
value:
- sub_tenant_id: <sub_tenant_id>
total_app_count: 10
total_app_mobile_users: 10
total_app_proxy_nodes: 10
total_app_remote_network: 10
description: Success
'400':
description: Bad Request
'500':
description: Server Error
security:
- Bearer: []
summary: List applications by source
tags:
- Data Resource API
/mt/monitor/v1/agg/applications/summary:
post:
description: "Retrieve an aggregated summary count of risky applications across tenants. \n"
operationId: post-mt-monitor-v1-agg-applications-summary
parameters:
- description: "Must be `tenant`. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned. \n"
example: tenant
in: query
name: agg_by
schema:
type: string
- description: "Must be one of the following: `de`, `americas`, `europe`, `uk`, `sg`, `ca`, `jp`, `au`, `in`. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is `americas` CDL region. \n"
example: americas
in: header
name: X-PANW-Region
schema:
type: string
requestBody:
content:
application/json:
examples:
Blocked Risky Apps:
value:
filter:
operator: AND
rules:
- operator: last_n_days
property: event_time
values:
- 7
properties:
- property: total_app_count
- property: risk_of_app_count
- property: blocked_app_count
Top Tenants using Risky Applications:
value:
count: 4
filter:
operator: AND
rules:
- operator: last_n_days
property: event_time
values:
- 30
properties:
- property: sub_tenant_id
- alias: value
property: risk_of_app_count
sort:
order: desc
Total Risky Apps:
value:
filter:
operator: AND
rules:
- operator: last_n_days
property: event_time
values:
- 7
properties:
- property: total_app_count
- property: risk_of_app_count
Total Risky Apps Per Tenant:
value:
filter:
operator: AND
rules:
- operator: last_n_days
property: event_time
values:
- 7
properties:
- property: sub_tenant_id
- property: total_app_count
- property: risk_of_app_count
Unblocked Risky Apps:
value:
filter:
operator: AND
rules:
- operator: last_n_days
property: event_time
values:
- 7
properties:
- property: total_app_count
- property: risk_of_app_count
- property: unblocked_app_count
schema:
$ref: '#/components/schemas/RequestBody_AppSummary'
responses:
'200':
content:
application/json:
examples:
Blocked Risky Apps:
value:
- blocked_apps_count: 10
risk_of_app_count: 10
total_app_count: 10
Top Tenants using Risky Applications:
value:
- sub_tenant_id: <sub-tenant-id>
value: 6
Total Risky Apps:
value:
- risk_of_app_count: 10
total_app_count: 10
Total Risky Apps Per Tenant:
value:
- risk_of_app_count: 10
sub_tenant_id: <sub_tenant_id>
total_app_count: 10
Unblocked Risky Apps:
value:
- risk_of_app_count: 10
total_app_count: 10
unblocked_apps_count: 10
description: Success
'400':
description: Bad Request
'500':
description: Server Error
security:
- Bearer: []
summary: List app summary
tags:
- Data Resource API
/mt/monitor/v1/agg/incidents/count:
post:
description: Get incident count by severity
operationId: post-mt-monitor-v1-agg-incidents-count
parameters:
- description: The value should be 'tenant'(if you want aggregated results across all child tenants) or empty.
example: tenant
in: query
name: agg_by
schema:
type: string
- description: This will be one of the 9 supported regions(americas, europe, au,de, jp, ca, sg, uk, in)
example: americas
in: header
name: X-PANW-Region
schema:
type: string
requestBody:
content:
application/json:
examples:
Incidents Count By Severity:
value:
filter:
rules:
- operator: last_n_days
property: raised_time
values:
- '1'
- operator: equals
property: status
values:
- Raised
- operator: in
property: severity
values:
- Critical
- Warning
- operator: in
property: domain
values:
- External
- external
properties:
- property: total_count
- property: critical_count
- property: warning_count
schema:
$ref: '#/components/schemas/RequestBody_Incidents'
responses:
'200':
content:
application/json:
examples:
Incidents Count By Severity:
value:
- critical_count: 10
total_count: 20
warning_count: 10
description: Success
'400':
description: Bad Request
'500':
description: Server Error
security:
- Bearer: []
summary: Get incident count by severity
tags:
- Data Resource API
/mt/monitor/v1/agg/incidents/impactedList:
post:
description: Get list of impacted objects
operationId: post-mt-monitor-v1-agg-incidents-impactedlist
parameters:
- description: The value should be 'tenant'(if you want aggregated results across all child tenants) or empty.
example: tenant
in: query
name: agg_by
schema:
type: string
- description: This will be one of the 9 supported regions(americas, europe, au,de, jp, ca, sg, uk, in)
example: americas
in: header
name: X-PANW-Region
schema:
type: string
requestBody:
content:
application/json:
examples:
List Of Impacted Objects:
value:
filter:
operator: AND
rules:
- operator: last_n_days
property: event_time
values:
- '60'
- operator: in
property: incident_id
values:
- f2e7e5b7-c635-41e9-abfa-06697a382ebf
schema:
$ref: '#/components/schemas/RequestBody_Incidents'
responses:
'200':
content:
application/json:
examples:
List Of Impacted Objects:
value:
- bgp_peers:
- BGP1
impacted_list: result
locations:
- LocationA
sites:
- SiteA
tunnels:
- TunnelA
description: Success
'400':
description: Bad Request
'500':
description: Server Error
security:
- Bearer: []
summary: Get list of impacted objects
tags:
- Data Resource API
/mt/monitor/v1/agg/incidents/list:
post:
description: Get list of incidents
operationId: post-mt-monitor-v1-agg-incidents-list
parameters:
- description: The value should be 'tenant'(if you want aggregated results across all child tenants) or empty.
example: tenant
in: query
name: agg_by
schema:
type: string
- description: This will be one of the 9 supported regions(americas, europe, au,de, jp, ca, sg, uk, in)
example: americas
in: header
name: X-PANW-Region
schema:
type: string
requestBody:
content:
application/json:
examples:
List Of Incidents:
value:
filter:
operator: AND
rules:
- operator: last_n_days
property: updated_time
values:
- 1
- operator: in
property: domain
values:
- External
- external
properties:
- property: incident_id
- property: title
- property: sub_tenant_id
- property: severity
- property: category
- property: sub_category
- property: status
- property: created_time
# --- truncated at 32 KB (109 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-data-resource-api-api-openapi.yml