Overview

The Palo Alto Networks Panorama integration brings your firewall-managed network inventory into the Praetorian Guard Platform (PGP), giving you visibility into assets that your firewall infrastructure already knows about but that may be missing from your attack surface. Panorama centrally manages address objects — the IPs, CIDR blocks, FQDNs, and IP ranges that define your protected environment — and this integration imports them directly into PGP as assets without any manual data entry.

This is especially valuable for organizations managing large-scale firewall deployments across multiple device groups. Rather than reconciling Panorama and PGP separately, the integration automatically surfaces firewall-managed assets so they can be assessed, scanned, and tracked as part of your broader security posture. If Panorama knows about an address that PGP hasn't discovered through external scanning, you'll see it — closing gaps in your attack surface coverage.

What the Integration Does

The integration is read-only: PGP queries your Panorama instance's REST API and imports address objects as assets. It does not modify any configuration, policies, or objects in Panorama.

Support for Internally Deployed Panorama Servers

For deployment where the Panorama server is not accessible externally, the platform supports ingesting Configurations export files. Scroll down to the Working with Configurations Export section on how to configure it

How it works:

1. Authentication — PGP authenticates to your Panorama REST API using the API key you provide, passed via the X-PAN-KEY header over HTTPS.

2. Address object enumeration — PGP queries the Objects/Addresses and Objects/AddressGroups endpoints to retrieve all address objects from your configured scope (a specific device group or the shared address space).

3. Asset creation — Each address object is mapped to a PGP asset and tagged with the paloalto cloud service identifier, linked back to its originating device group.

4. Affiliation tracking — On subsequent runs, PGP checks whether previously imported assets still exist in Panorama. If an address object is removed from Panorama, PGP detects the change.

Imported Address Types

Address groups (both static and dynamic) are also discovered for metadata enrichment, providing additional context about how your firewall policies organize these assets.

Scoping

If you specify a device group during setup, only address objects within that group are imported. If you leave the device group field blank, PGP queries the shared location, pulling in address objects available across all device groups.

Prerequisites

Before setting up the integration, you need:

• A Panorama instance accessible over HTTPS from PGP

• An API key generated from a Panorama administrator account with read access to address objects

• Network connectivity between PGP and your Panorama instance — if Panorama is behind a corporate firewall, ensure appropriate access is configured

Creating an API Key

1. Log in to the Panorama web interface

2. Navigate to Device > Administrators (or use the XML API keygen endpoint: type=keygen&user=<USER>&password=<PASS>)

3. Generate a new API key for a user account with at least read-only access to Objects

4. Copy the key — it is displayed only once

Recommended Permissions

For least-privilege access, create a custom admin role in Panorama:

Alternatively, the predefined Superuser (Read Only) role works but grants broader access than necessary.

PAN-OS version note: PAN-OS 10.2 and later provide separate permission tabs for REST API and XML API, allowing more granular control. The integration defaults to REST API version v11.1. If your Panorama instance runs an older PAN-OS version, you can specify a different API version during setup.

Setup

1. In PGP, navigate to Integrations and locate Palo Alto Networks Panorama under the Firewall category.

2. Click Integrate on Palo Alto Network Panorama Card

2. Enter values for the following fields and click connect.

3. Click Connect. PGP validates your credentials by making a lightweight test call to the Panorama API (Objects/Addresses?limit=1). If validation succeeds, the integration begins importing address objects on its next scheduled run.

What Data Is Synced

Address Objects to PGP Assets

• Every address object in your configured scope (device group or shared) is imported as a PGP asset

• Assets are tagged with the paloalto cloud service identifier

• Each asset retains a reference to its Panorama device group and object name for traceability

• On subsequent runs, PGP reconciles the current Panorama state — new objects are added, removed objects are detected via affiliation checks

Address Groups (Metadata Only)

• Static and dynamic address groups are enumerated for context

• Group membership data enriches the understanding of how your firewall policies organize assets

• Groups themselves are not created as standalone assets

Panorama API Endpoints Used

Both endpoints accept location=shared or location=device-group&device-group={name} to control scope.

Troubleshooting

Security and Data Handling

• PGP uses your API key exclusively for read-only REST API calls — it never modifies any configuration, policies, address objects, or other settings in Panorama

• The API key is encrypted at rest and in transit within your PGP deployment

• Only address object metadata is imported (names, IPs, FQDNs, tags, descriptions) — no firewall logs, traffic data, or credentials are accessed

• PGP authenticates via the X-PAN-KEY HTTP header over HTTPS; the API key is never logged or exposed in error messages

Working with Configuration Exports

For Panorama deployments where the API endpoints are inaccessible externally, the platform supports ingesting device data from Panorama’s Configuration exports. Configuration export files contain data on the devices managed by Panorama. Here are the steps:

• Configure a schedule for exporting Configurations. You will need an SFTP or SCP server. See Panorama’s documentation here.

• On the SFTP/SCP server, periodically upload the exported file to the Documents system of the Guard Platform. It should be a *.gz file. Use the Praetorian CLI to do so securely. See our CLI documentation on installation and configuration.

As an example, run this CLI command on a cron job to upload the exported file to your tenant in the Guard platform; adopt the file path in the command to your environment:

guard add file /path-to-scp-server-store/panorama-config-export.gz

• After uploading the first configuration export file, configure a Panorama integration connection using the config export option:

Integration category: Firewall. Data direction: Read-only (Panorama to PGP). Authentication: API key via X-PAN-KEY header.