Palo Alto Networks

Palo Alto Networks Defenders API

{'$ref': 'desc/defenders/defenders.md'}

GitHub OpenAPI
Business capability
Cybersecurity Management BC-620

Operations 44

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /api/v34.03/defenders List deployed Defenders (API v34.03) · Get Deployed Defenders #
Ask an LLM
“Which Defenders are deployed in my Compute console, per the v34.03 API?”
“Can the v34.03 Defenders list show only disconnected agents or ones on an expired CA?”
Tell an agent
Using API v34.03, list deployed Defenders on host {hostname}.
With the v34.03 endpoint, list Defenders in cluster {cluster} filtered by connected={connected}.
POST /api/v34.03/defenders/aci.yaml Add Defenders to an ACI container group YAML (v34.03) · A CI Container Group Y A M L #
Ask an LLM
“Can the v34.03 API inject a Defender into my Azure Container Instances group YAML?”
“What does the v34.03 ACI YAML endpoint return after it augments my container group definition?”
Tell an agent
Using API v34.03, augment my ACI container group YAML with a Defender pointing at console {consoleaddr}.
Via v34.03, protect my ACI container group YAML using Defender image {defenderImage}.
POST /api/v34.03/defenders/app-embedded Generate an App-Embedded Defender Dockerfile (v34.03) · Generate a Docker File for App-embedded Defender #
Ask an LLM
“Can the v34.03 API rewrite my Dockerfile to embed a Defender in the app?”
“What inputs does the v34.03 app-embedded Defender Dockerfile generator need?”
Tell an agent
Using API v34.03, generate an App-Embedded Defender Dockerfile for app {appID}.
With the v34.03 endpoint, embed a Defender into Dockerfile {dockerfile} using data folder {dataFolder}.
POST /api/v34.03/defenders/cloud-run.yaml Add Defenders to a Cloud Run service YAML (v34.03) · Cloud Run Service Y A M L #
Ask an LLM
“Can the v34.03 API add a Defender to my Google Cloud Run service YAML?”
“Does the v34.03 Cloud Run YAML generator support filesystem monitoring?”
Tell an agent
Using API v34.03, augment my Cloud Run service YAML with a Defender reporting to {consoleaddr}.
Via v34.03, protect my Cloud Run service YAML with filesystem monitoring set to {filesystemMonitoring}.
POST /api/v34.03/defenders/daemonset.yaml Generate a Defender DaemonSet YAML (v34.03) · Generate Daemonset Deployment YAML File #
Ask an LLM
“How do I get a Kubernetes DaemonSet YAML to roll out Defenders using API v34.03?”
“Can the v34.03 DaemonSet generator set CPU and memory limits for the Defender pods?”
Tell an agent
Using API v34.03, generate a Defender DaemonSet YAML for cluster {cluster} in namespace {namespace}.
Via v34.03, build a Defender DaemonSet YAML for the {orchestration} orchestrator with container runtime {containerRuntime}.
GET /api/v34.03/defenders/download Download the deployed Defenders list as CSV (v34.03) · Download Deployed Defenders #
Ask an LLM
“Can I export my deployed Defenders to a file with the v34.03 API?”
“Which filters apply when downloading the Defender inventory through v34.03?”
Tell an agent
Using API v34.03, download the deployed Defenders report for cluster {cluster}.
Via v34.03, export a file of every Defender running an old CA.
POST /api/v34.03/defenders/eks-fargate.yaml Add Defenders to an EKS Fargate manifest (v34.03) · Generate K8s Controller Manifest #
Ask an LLM
“Can the v34.03 API inject Defenders into a Kubernetes controller manifest for EKS on Fargate?”
“What comes back from the v34.03 EKS Fargate manifest generator?”
Tell an agent
Using API v34.03, augment my EKS Fargate controller manifest with Defenders reporting to {consoleaddr}.
Via v34.03, protect my EKS Fargate Kubernetes manifest with Defender image {defenderImage}.
POST /api/v34.03/defenders/fargate.json Protect an ECS Fargate task definition in JSON (v34.03) · Generate a Protected JSON Fargate Task Definition #
Ask an LLM
“Can the v34.03 API return a protected Fargate task definition in JSON?”
“Does the v34.03 JSON Fargate generator support CloudFormation output?”
Tell an agent
Using API v34.03, generate a protected JSON Fargate task definition pulling from registry type {registryType}.
Via v34.03, protect my Fargate task definition in JSON with Defender type {defenderType}.
POST /api/v34.03/defenders/fargate.yaml Protect an ECS Fargate task definition in YAML (v34.03) · Generate a Protected YAML Fargate Task Definition #
Ask an LLM
“Can the v34.03 API return a protected Fargate task definition as YAML instead of JSON?”
“Can v34.03 extract the entrypoint when building a YAML Fargate task definition?”
Tell an agent
Using API v34.03, generate a protected YAML Fargate task definition with registry credential {registryCredentialID}.
Via v34.03, produce a YAML Fargate task definition protected by Defender image {defenderImage}.
POST /api/v34.03/defenders/helm/twistlock-defender-helm.tar.gz Generate a Defender Helm chart (v34.03) · Generate a Helm Deployment Chart for Defender #
Ask an LLM
“Can I get a Helm chart for deploying Defenders from the v34.03 API?”
“Does the v34.03 Helm chart support GKE Autopilot or Bottlerocket nodes?”
Tell an agent
Using API v34.03, generate a Defender Helm chart for cluster {cluster} in namespace {namespace}.
Via v34.03, build the Defender Helm tarball using image {image} and proxy {proxy}.
GET /api/v34.03/defenders/image-name Get the Defender Docker image name (v34.03) · Get Docker Image Name for Defender #
Ask an LLM
“What Docker image name should I pull for the Defender, per API v34.03?”
“Where does the v34.03 API tell me the Defender container image to use?”
Tell an agent
Using API v34.03, fetch the Defender Docker image name.
Via v34.03, tell me which container image the Defender runs as.
GET /api/v34.03/defenders/install-bundle Get the Defender certificate install bundle (v34.03) · Get Certificate Bundle for Defender #
Ask an LLM
“Where do I get the certificate bundle a Defender needs to install, via API v34.03?”
“Can the v34.03 install bundle be scoped to a specific Defender type?”
Tell an agent
Using API v34.03, get the Defender certificate install bundle for console {consoleaddr}.
Via v34.03, fetch the install bundle for Defender type {defenderType}.
GET /api/v34.03/defenders/names List Defender hostnames only (v34.03) · Get Defender Names #
Ask an LLM
“Can I get just the names of my Defenders, without full details, from API v34.03?”
“Which Defender names does v34.03 return for a given cluster?”
Tell an agent
Using API v34.03, list the names of Defenders in cluster {cluster}.
Via v34.03, return only the Defender names for role {role}.
POST /api/v34.03/defenders/serverless/bundle Generate a serverless Defender bundle (v34.03) · Generate Serverless Bundle for Defender #
Ask an LLM
“Can I get a serverless Defender bundle for my Lambda runtime with API v34.03?”
“Which cloud providers and runtimes does the v34.03 serverless bundle cover?”
Tell an agent
Using API v34.03, generate a serverless Defender bundle for provider {provider} and runtime {runtime}.
Via v34.03, build a serverless Defender bundle that trusts proxy CA {proxyCA}.
GET /api/v34.03/defenders/summary Get the Defenders summary (v34.03) · Get Defenders Summary #
Ask an LLM
“How many Defenders do I have by category, according to the v34.03 summary?”
“What overview of my Defender fleet does API v34.03 give?”
Tell an agent
Using API v34.03, show the Defenders summary.
Via v34.03, give me a roll-up count of my deployed Defenders.
GET /api/v34.03/defenders/tas-cloud-controller-address Get TAS cloud controller addresses for Defenders (v34.03) · Defenders Tas Cloud Controller Address #
Ask an LLM
“Which Tanzu Application Service cloud controller addresses do my Defenders report, per v34.03?”
“Can I look up TAS cloud controller addresses by foundation using API v34.03?”
Tell an agent
Using API v34.03, list the TAS cloud controller addresses for foundations {tasFoundations}.
Via v34.03, get TAS cloud controller addresses for TAS clusters {tasClusterIDs}.
POST /api/v34.03/defenders/upgrade Upgrade all connected single Linux Defenders (v34.03) · Upgrade Connected Single Linux Defenders #
Ask an LLM
“Can I upgrade every connected single Linux Defender at once with API v34.03?”
“Does the v34.03 bulk Defender upgrade accept a cluster or hostname filter?”
Tell an agent
Using API v34.03, upgrade all connected single Linux Defenders in cluster {cluster}.
Via v34.03, bulk-upgrade the connected Linux Defenders that are not on the latest version.
DELETE /api/v34.03/defenders/{id} Delete a Defender (v34.03) · Delete a Defender #
Ask an LLM
“How do I remove a Defender from my console with the v34.03 API?”
“What happens to a decommissioned host's Defender record when I delete it via v34.03?”
Tell an agent destructive · confirm first
Using API v34.03, delete Defender {id}.
Via v34.03, remove the Defender record for host {id} from the console.
POST /api/v34.03/defenders/{id}/features Update a Defender's features (v34.03) · Update Defender Configuration #
Ask an LLM
“Can I turn on cluster monitoring for one Defender using the v34.03 API?”
“Which Defender settings can v34.03 change, like the proxy listener type?”
Tell an agent
Using API v34.03, set cluster monitoring to {clusterMonitoring} on Defender {id}.
Via v34.03, change Defender {id} proxy listener type to {proxyListenerType}.
POST /api/v34.03/defenders/{id}/restart Restart a Defender (v34.03) · Restart a Defender #
Ask an LLM
“Can I restart a single stuck Defender remotely with API v34.03?”
“Is there a v34.03 call to restart one Defender by its hostname?”
Tell an agent
Using API v34.03, restart Defender {id}.
Via v34.03, bounce the Defender running on {id}.
POST /api/v34.03/defenders/{id}/upgrade Upgrade one Defender (v34.03) · Upgrade a Defender #
Ask an LLM
“How do I upgrade just one Defender to the console's version via API v34.03?”
“Can v34.03 upgrade a single Defender without touching the rest of the fleet?”
Tell an agent
Using API v34.03, upgrade Defender {id}.
Via v34.03, bring the Defender on host {id} up to the current version.
GET /api/v34.04/defenders List deployed Defenders (API v34.04) · Get Deployed Defenders #
Ask an LLM
“On the newer v34.04 release, what agents are currently running across my hosts?”
“Does v34.04 let me filter the agent inventory to ARM64 machines or VPC observers?”
Tell an agent
Show me every v34.04 agent installed on machine {hostname}.
Pull the v34.04 Defender inventory of kind {type}, ordered by {sort}.
POST /api/v34.04/defenders/aci.yaml Add Defenders to an ACI container group YAML (v34.04) · A CI Container Group Y A M L #
Ask an LLM
“Does the current v34.04 release accept an Azure Container Instances group definition and hand back a secured one?”
“Which interpreter options apply when v34.04 secures my ACI group spec?”
Tell an agent
Take this Azure container group spec and return a v34.04 secured version that talks to {consoleaddr}.
Secure my ACI group spec on v34.04, running interpreter {interpreter}.
POST /api/v34.04/defenders/app-embedded Generate an App-Embedded Defender Dockerfile (v34.04) · Generate a Docker File for App-embedded Defender #
Ask an LLM
“On v34.04, can my container build file get a runtime agent baked right into the application image?”
“Is filesystem monitoring available for app-embedded agents in the v34.04 release?”
Tell an agent
Produce a v34.04 build file with an embedded agent for application {appID}.
Bake the v34.04 runtime agent into this image build, reporting to console {consoleAddr}.
POST /api/v34.04/defenders/cloud-run.yaml Add Defenders to a Cloud Run service YAML (v34.04) · Cloud Run Service Y A M L #
Ask an LLM
“Will the current v34.04 release secure a Google serverless container service spec for me?”
“Which Defender image does v34.04 put into the Cloud Run spec it returns?”
Tell an agent
Secure this Cloud Run spec on v34.04 so it reports to console {consoleaddr}.
Return a v34.04 hardened Cloud Run spec that uses agent image {defenderImage}.
POST /api/v34.04/defenders/daemonset.yaml Generate a Defender DaemonSet YAML (v34.04) · Generate Daemonset Deployment YAML File #
Ask an LLM
“With the v34.04 release, what manifest puts an agent on every node of my Kubernetes cluster?”
“Does v34.04 node-wide manifest generation handle Talos, SELinux or nftables?”
Tell an agent
Create a v34.04 per-node agent manifest for {cluster}, deploying into {namespace}.
Give me the v34.04 node agent manifest with a memory cap of {memoryLimit} and a CPU cap of {cpuLimit}.
GET /api/v34.04/defenders/download Download the deployed Defenders list as CSV (v34.04) · Download Deployed Defenders #
Ask an LLM
“Is there a v34.04 export that saves my whole agent fleet to a spreadsheet?”
“In the current v34.04 release, can I export only agents on outdated, unsupported versions?”
Tell an agent
Save a v34.04 spreadsheet of agents tagged with role {role}.
Export the v34.04 agent fleet file, limited to hosts whose CA has expired.
POST /api/v34.04/defenders/eks-fargate.yaml Add Defenders to an EKS Fargate manifest (v34.04) · Generate K8s Controller Manifest #
Ask an LLM
“Does the v34.04 release secure a Kubernetes workload manifest bound for serverless EKS pods?”
“What interpreter settings does v34.04 accept when securing an EKS Fargate workload?”
Tell an agent
Harden this EKS serverless pod manifest on v34.04 so the agents call home to {consoleaddr}.
Secure my Fargate-on-EKS workload spec through v34.04 with interpreter {interpreter}.
POST /api/v34.04/defenders/fargate.json Protect an ECS Fargate task definition in JSON (v34.04) · Generate a Protected JSON Fargate Task Definition #
Ask an LLM
“With the v34.04 release, can I hand over an ECS task and get back a secured JSON version?”
“Does the current v34.04 JSON task hardening accept an image pull secret for the agent?”
Tell an agent
Secure my ECS task as JSON on v34.04, pulling the agent with secret {defenderImagePullSecret}.
Return a v34.04 hardened ECS task in JSON, formatted for CloudFormation set to {cloudFormation}.
POST /api/v34.04/defenders/fargate.yaml Protect an ECS Fargate task definition in YAML (v34.04) · Generate a Protected YAML Fargate Task Definition #
Ask an LLM
“Does the v34.04 release output a hardened ECS serverless task in YAML format?”
“Which registry types can the current v34.04 YAML task hardening pull the agent from?”
Tell an agent
Harden my ECS task as YAML on v34.04, using registry {registryType}.
Return a v34.04 secured ECS task in YAML with entrypoint extraction set to {extractEntrypoint}.
POST /api/v34.04/defenders/helm/twistlock-defender-helm.tar.gz Generate a Defender Helm chart (v34.04) · Generate a Helm Deployment Chart for Defender #
Ask an LLM
“Where can I download a packaged chart tarball to install agents with helm on the v34.04 release?”
“Does the v34.04 chart accept node selectors, tolerations and a priority class?”
Tell an agent
Package a v34.04 helm tarball for {cluster} that runs with service accounts {serviceaccounts}.
Build the v34.04 chart with node selector {nodeSelector} and tolerations {tolerations}.
GET /api/v34.04/defenders/image-name Get the Defender Docker image name (v34.04) · Get Docker Image Name for Defender #
Ask an LLM
“On the current v34.04 release, which registry path and tag is the agent image published under?”
“Is the agent container reference exposed by the v34.04 API for my own pull scripts?”
Tell an agent
Look up the v34.04 agent container reference.
Tell me what image tag v34.04 expects my nodes to pull for the agent.
GET /api/v34.04/defenders/install-bundle Get the Defender certificate install bundle (v34.04) · Get Certificate Bundle for Defender #
Ask an LLM
“With v34.04, where are the certs an agent uses to trust and authenticate to the console?”
“Does the v34.04 release let me grab install certificates for a particular interpreter?”
Tell an agent
Retrieve the v34.04 agent certificates for interpreter {interpreter}.
Grab the v34.04 installation certs bundle for agent kind {defenderType}.
GET /api/v34.04/defenders/names List Defender hostnames only (v34.04) · Get Defender Names #
Ask an LLM
“In the v34.04 release, is there a lightweight lookup returning only agent identifiers?”
“What agent hostnames does v34.04 give back when I filter to connected ones?”
Tell an agent
Fetch the v34.04 agent identifier list, filtered to connected={connected}.
Give me v34.04 agent hostnames only, capped at {limit}.
POST /api/v34.04/defenders/serverless/bundle Generate a serverless Defender bundle (v34.04) · Generate Serverless Bundle for Defender #
Ask an LLM
“On the v34.04 release, what package do I add to my functions to protect them?”
“Does the current v34.04 function protection package need my proxy certificate authority?”
Tell an agent
Build the v34.04 function protection package for cloud {provider}.
Package a v34.04 function-protection agent for language runtime {runtime}.
GET /api/v34.04/defenders/summary Get the Defenders summary (v34.04) · Get Defenders Summary #
Ask an LLM
“Is there a v34.04 dashboard-style tally of my agent fleet?”
“What high-level agent totals does the current v34.04 release report?”
Tell an agent
Report the v34.04 agent fleet tally.
Summarize my v34.04 agents in one overview.
GET /api/v34.04/defenders/tas-cloud-controller-address Get TAS cloud controller addresses for Defenders (v34.04) · Defenders Tas Cloud Controller Address #
Ask an LLM
“On v34.04, what controller endpoints are my Tanzu-hosted agents connected to?”
“Can the current v34.04 release show which Tanzu controller the blobstore scanners use?”
Tell an agent
Show the v34.04 Tanzu controller endpoint for blobstore scanner {tasBlobstoreScanner}.
Find v34.04 Tanzu controller endpoints for agents on host {hostname}.
POST /api/v34.04/defenders/upgrade Upgrade all connected single Linux Defenders (v34.04) · Upgrade Connected Single Linux Defenders #
Ask an LLM
“With v34.04, can I push the latest agent version to every connected standalone Linux host in one call?”
“Does the v34.04 fleet-wide upgrade skip agents that are already current?”
Tell an agent
Roll the v34.04 fleet upgrade out to standalone Linux agents on host {hostname}.
Push the v34.04 mass upgrade to every connected standalone Linux agent.
DELETE /api/v34.04/defenders/{id} Delete a Defender (v34.04) · Delete a Defender #
Ask an LLM
“Can I purge a retired agent from the console on the v34.04 release?”
“Is removing an agent permanent when done through v34.04?”
Tell an agent destructive · confirm first
Purge agent {id} via v34.04.
Drop the retired v34.04 agent entry {id} from my console.
POST /api/v34.04/defenders/{id}/features Update a Defender's features (v34.04) · Update Defender Configuration #
Ask an LLM
“On the current v34.04 release, can one agent be switched to monitor its cluster?”
“Which per-agent features does v34.04 let me toggle?”
Tell an agent
Toggle v34.04 cluster monitoring {clusterMonitoring} for agent {id}.
Reconfigure v34.04 agent {id} to listen as {proxyListenerType}.
POST /api/v34.04/defenders/{id}/restart Restart a Defender (v34.04) · Restart a Defender #
Ask an LLM
“With v34.04, can I reboot one unresponsive agent without logging into its host?”
“Does the v34.04 release support a remote relaunch of a single agent?”
Tell an agent
Relaunch agent {id} using v34.04.
Reboot the unresponsive v34.04 agent {id} remotely.
POST /api/v34.04/defenders/{id}/upgrade Upgrade one Defender (v34.04) · Upgrade a Defender #
Ask an LLM
“On v34.04, can I move a single lagging agent onto the console's release?”
“Will a v34.04 per-agent update leave my other hosts untouched?”
Tell an agent
Update only agent {id} on v34.04.
Move the lagging v34.04 agent {id} to the console release.
GET /defenders List Defenders on the unversioned endpoint · Palo Alto Networks List Defenders #
Ask an LLM
“Is there an unversioned Defenders endpoint that searches agents by name and shows their connection status?”
“Which Defenders are running on which hosts, using the legacy /defenders path without a version?”
Tell an agent
On the unversioned /defenders endpoint, search Defenders matching {search}.
Using the non-versioned Defenders list, show {type} Defenders in cluster {cluster}.
GET /defenders/summary Get Defender statistics on the unversioned endpoint · Palo Alto Networks Get Defender Summary Statistics #
Ask an LLM
“What is my Defender version distribution and deployment type breakdown from the unversioned summary endpoint?”
“How many Defenders are connected out of the total, per the legacy /defenders/summary path?”
Tell an agent
From the unversioned summary endpoint, show Defender counts by version and deployment type.
Using the non-versioned /defenders/summary path, report total versus connected Defenders.

Specifications

⚙
OpenAPI
https://artifacts.apis.io/palo-alto-networks/openapi/palo-alto-networks-defenders-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-defenders-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-defenders-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks Defenders API
  x-refined-note:
  - x-description-source differs across the merged source definitions and was not carried
  version: '1.0'
  description: 'Operations tagged Defenders across 3 of this provider''s published API definitions: palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json, palo-alto-compute-openapi-34-04-145-sh-openapi.json, palo-alto-prisma-cloud-compute-api-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{console}/api/v1
  description: Prisma Cloud Compute Console API.
  variables:
    console:
      default: console.example.com
      description: Address of the Prisma Cloud Compute Console. For SaaS deployments, use the address provided in Prisma Cloud under Compute > Manage > System > Utilities.
tags:


# --- truncated at 32 KB (130 KB total) ---
# Full source: https://artifacts.apis.io/palo-alto-networks/openapi/palo-alto-networks-defenders-api-openapi.yml