# Palo Alto Networks Firewall {% hint style="success" %} This is a separate from the "Palo Alto Cortex XDR" cloud and EDR data and alert source. {% endhint %} The Dropzone AI Platform integrates with Palo Alto Networks Firewall, a leading next-generation firewall solution. Integrating Palo Alto with Dropzone allows Dropzone to automatically investigate security incidents by analyzing network traffic data within the firewall ecosystem. Additionally, Dropzone can assess threat logs from Palo Alto Firewall, enabling deeper investigations into potential attacks and enhancing proactive threat detection and response. ## Integrations Overview To enable these integrations you will perform the following actions: * Create an Admin with Read Only permissions * Generate an API key ## Create an Admin Role Profile * At the top of your Palo Alto account, navigate to Device

* In the left sidebar, navigate to Admin Roles

* In the bottom left corner, click "Add"

* Click XML API and enable the Log and Operational Requests permissions * Name the Admin Role Profile something memorable, such as "Dropzone-AI" * Click "OK"

* In the left sidebar, navigate to Administrators

* In the bottom corner, click "Add"

* Name the new administrator something memorable, such as "Dropzone-Admin", and create a memorable password. Be sure to save these, as they will be used later to generate the API token * Assign the administrator the "Role Based" type * In "Profile", select the name of the profile you just created * Click "Ok"

* In the top corner, click "Commit"

## Generate an API Key To obtain an API Key, do the following: * Using the administrative credentials you just generated, SSH into the Palo Alto firewall * Run the following commands: ``` https:///api/?type=keygen&user= ``` ``` curl -k http(s)://:/api/\?type\=keygen\&user\=\&password\= ``` * Copy the API key generated and store it in a safe location for use later in the Dropzone UI where it is called "API key" * For further information, see the Palo Alto [API documentation](https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/get-your-api-key) ## Enable Palo Alto Networks Firewall To enable the Alert Source integration, you will need the following information: | Dropzone Field | Source | | -------------- | ----------------------------------------------------------------------------- | | Server | The same as your company server url in Palo Alto, eg https\://<111.22.33.444> | | API Key | The API key value you generated earlier | * Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app * In the bottom left hand corner, click Settings > Integrations

* Click "Available"

* In the Search bar, search Palo Alto Networks Firewall, then click "Configure"

* Under the Alert Source heading, if your Palo Alto integration is behind an [On-premise Dropzone Connector](https://docs.dropzone.ai/platform/settings/connector), select your connector from the dropdown * Input the Server and the API Key

The Palo Alto Alert configuration (pt 1)

* Under "Filter on Severity," select the severity levels of alerts you wish for Dropzone AI to investigate

The Palo Alto Alert configuration (pt 2)

* In the "Threat Name" section, you may input an array of Python regex patterns to include or exclude specific threats by [name](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields). To do so, select whether to exlude or include the listed threat names, then click "Add Item" and input the array

The Palo Alto Alert configuration (pt 3)

* Under "Filter on Action," select which [action types](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields#id83052cb2-4798-4f9c-abf8-e0b929ce7a3b) you want Dropzone to investigate

The Palo Alto Alert configuration (pt 4)

* Under "Threat Category," select the [threat categories](https://docs.paloaltonetworks.com/advanced-threat-prevention/administration/threat-prevention/threat-signature-categories) you want Dropzone to investigate

The Palo Alto Alert configuration (pt 5)

* Input your desired Poll interval and lookback

The Palo Alto Alert configuration (pt 6)

* Click "Test & Save" to finish If you have any errors, engage your Dropzone AI support representative.