Palo Alto Networks

Palo Alto Networks Vulnerability Protection Signatures API

Vulnerability Protection Signatures

GitHub OpenAPI
Business capability
Cybersecurity Management BC-620

Operations 10

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /vulnerability-protection-signatures List custom vulnerability signatures · List vulnerability protection signatures #
Ask an LLM
“Which custom vulnerability protection signatures exist in a folder?”
“Can I page through vulnerability signatures on a device?”
Tell an agent
List vulnerability protection signatures in folder {folder}.
Show {limit} vulnerability signatures from snippet {snippet}.
POST /vulnerability-protection-signatures Create a custom vulnerability signature · Create a vulnerability protection signature #
Ask an LLM
“How do I write a custom vulnerability protection signature for an exploit?”
“What affected host, direction and severity does a new vulnerability signature need?”
Tell an agent
Create vuln signature {threatname}, threat {threat_id}, severity {severity}, direction {direction}, host {affected_host}, pattern {signature}.
Add a vulnerability signature for CVE {cve} named {threatname}.
GET /vulnerability-protection-signatures/{id} Get a vulnerability protection signature · Get a vulnerability protection signature #
Ask an LLM
“What CVE and affected host does a given vulnerability signature cover?”
“Can I read a vulnerability signature by ID?”
Tell an agent
Get vulnerability protection signature {id}.
Show the CVE and severity on vulnerability signature {id}.
PUT /vulnerability-protection-signatures/{id} Update a vulnerability protection signature · Update a vulnerability protection signature #
Ask an LLM
“Can I change the default action on a custom vulnerability signature?”
“How do I update the affected host on an existing vulnerability signature?”
Tell an agent
Update vulnerability signature {id} to severity {severity}.
Set default action {default_action} on vulnerability signature {id}.
DELETE /vulnerability-protection-signatures/{id} Delete a vulnerability protection signature · Delete a vulnerability protection signature #
Ask an LLM
“How do I remove a custom vulnerability protection signature?”
“Is a deleted vulnerability signature gone for good?”
Tell an agent destructive · confirm first
Delete vulnerability protection signature {id}.
Remove the custom vulnerability signature {id}.
GET /sse/config/v1/vulnerability-protection-signatures List custom vulnerability signatures · List vulnerability protection signatures #
Ask an LLM
“Which custom vulnerability protection signatures exist through the SSE config v1 API?”
“Can I look up a vulnerability signature by name?”
Tell an agent
List vulnerability protection signatures in folder {folder} through the SSE config v1 endpoint.
Find vulnerability signature {name} in folder {folder}.
POST /sse/config/v1/vulnerability-protection-signatures Create a custom vulnerability signature · Create a vulnerability protection signature #
Ask an LLM
“How do I write a custom signature to block an exploit for a specific CVE?”
“What threat ID range is allowed for custom vulnerability signatures?”
Tell an agent
Create vulnerability signature {threatname} with threat ID {threat_id} in folder {folder}.
Add signature {threatname}, ID {threat_id}, for CVE {cve} with severity {severity} in {folder}.
DELETE /sse/config/v1/vulnerability-protection-signatures/{id} Delete a custom vulnerability signature · Delete a vulnerability-protection signature #
Ask an LLM
“Can I remove a custom vulnerability signature?”
“Is deleting a vulnerability protection signature permanent?”
Tell an agent destructive · confirm first
Delete vulnerability signature {id}.
Remove the custom vulnerability protection signature {id}.
GET /sse/config/v1/vulnerability-protection-signatures/{id} Get a custom vulnerability signature · Get a vulnerability protection signature by ID #
Ask an LLM
“Where can I see the details of one custom vulnerability signature?”
“What default action and severity does a given signature have?”
Tell an agent
Get vulnerability signature {id}.
Show the CVE and severity of vulnerability signature {id}.
PUT /sse/config/v1/vulnerability-protection-signatures/{id} Edit a custom vulnerability signature · Edit a vulnerability-protection signature #
Ask an LLM
“How do I change the default action of an existing vulnerability signature?”
“Can I raise the severity of a signature I already created?”
Tell an agent
Set vulnerability signature {id} ({threatname}, ID {threat_id}) to action {action}.
Change the severity of vulnerability signature {id} to {severity}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-vulnerability-protection-signatures-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-vulnerability-protection-signatures-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-vulnerability-protection-signatures-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  version: 2.0.0
  title: Security Services Vulnerability Protection Signatures API
  description: These APIs are used for defining and managing security services configurations within Strata Cloud Manager.
  termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
  contact:
    email: support@paloaltonetworks.com
    name: Palo Alto Networks Technical Support
    url: https://support.paloaltonetworks.com
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/config/security/v1
  description: Current
- url: https://api.sase.paloaltonetworks.com/sse/config/v1
  description: Legacy
security:
- scmToken: []
tags:


# --- truncated at 32 KB (39 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-vulnerability-protection-signatures-api-openapi.yml