Adding Paloalto Firewall as Custom Action Device

Overview

This article explains how to add a Palo Alto Networks Firewall as a response (action) device in Logsign, and what to do if the address group / URL category dropdown comes back empty when you're using a limited (non-superuser) PAN-OS admin role.

Adding the Device in Logsign

Using the Logsign USO Platform web interface, go to Settings > Integrations > Responses, then click + Device.

Generating the API Key

Generate the key against the firewall:

https://HOST_ADDRESS/api/?type=keygen&user=USER_NAME&password=PASSWORD

Copy the value inside <key>...</key> from the response into the Key field.

Important — this key inherits whatever Admin Role USER_NAME is assigned on the firewall. On PAN-OS, an Admin Role has two separate permission switches, XML API and REST API (Device > Admin Roles > your role), plus a separate Config permission. A superuser account has all of them enabled, which is why generating the key from an admin/admin-style superuser account "just works." If you generate the key from a limited custom role instead:

• Block-IP / Unblock-IP only need XML API access (User-ID operations), so these can work fine.
• The address group and URL category dropdowns in Logsign are populated via the firewall's REST API (Objects/AddressGroups, Objects/CustomURLCategories). If the role doesn't have REST API access enabled, these dropdowns come back empty, even though block-ip/unblock-ip succeed and the connection test in Logsign passes (the test only checks a basic version call).

If you're not using a superuser account to generate the key, ask your PAN-OS administrator to enable REST API > Objects > Address Groups (and Objects > Custom URL Categories if you plan to use Block-URL/Unblock-URL) on the Admin Role tied to this API user.

Preparing the Address Group on PAN-OS

On the firewall, go to Objects > Address Groups and create the group you want Logsign to manage, for example named BlockedUsers:

• Type: Dynamic, so the membership updates as Logsign registers/unregisters IPs.
• Match: set to the tag Logsign will use, for example block.

Attach this address group to the security policy that should enforce the block (Policies > Security).

Creating the Action Rule in Logsign

When creating the action rule, do not type the group name in by hand. The Group Name field is a synced dropdown, not a free-text field:

1. Save the device first, then open the sync (or edit the action rule) so Logsign fetches the current address group list from the firewall.
2. Select the group you created above (e.g. BlockedUsers) from the dropdown.
3. Set Match Key and Expire Time (or Permanent) as needed, then save.

If the dropdown is empty, this almost always means the API key's Admin Role lacks REST API access as described above — fix that on the firewall and re-sync, rather than typing the group name manually. A manually typed name that doesn't exactly match an existing address group will make Block-IP / Unblock-IP fail.

Frequently Asked Questions

Block-IP works but the group name dropdown is always empty. Why?

The API key's Admin Role has XML API access (enough for User-ID operations) but not REST API access (needed to list address groups). Ask your PAN-OS administrator to enable REST API access to Objects > Address Groups for that role.

It works with a superadmin-generated key but not with our limited API account — is this a Logsign issue?

No, this is a PAN-OS permission configuration difference between the two accounts' Admin Roles, not a Logsign-side authorization issue.

I typed the group name manually because the dropdown was empty and now the action fails or the error isn't clear. What do I do?

Fix the REST API permission so the dropdown populates, then pick the group from the list instead of typing it. A typed name that doesn't exist on the firewall as an address group will make the action fail.