The Dietze Haus

When I was early in my career, I thought of CCIEs almost like monks who had dedicated themselves completely to their craft. They seemed to operate at a different level. There were people I deeply respected who could look at a difficult networking problem, strip away the noise, and somehow get to the heart of it faster than everyone else in the room. One of those people was Sean Orta, an OG CCIE who became something of a technical oracle in my mind. I used to joke that when I needed to think through something difficult, I was going to "consult the Ortacle." The joke was lighthearted, but the respect behind it was very real.

I was recently told that querying Palo Alto Networks Strata Logging Service (SLS) directly through an API was not possible. I also found a few Reddit threads and older examples that pointed toward the legacy Cortex Data Lake APIs, but after spending some time with the Strata Cloud Manager Log Viewer and Chrome Developer Tools, it turns out that raw Traffic and Threat logs can be queried programmatically. The important caveat is that I have not found public Palo Alto documentation for the specific Log Viewer resources used below. The API is clearly being used by the Strata Cloud Manager UI, though, and it works with the normal service-account OAuth flow. API Endpoints For the US tenant I tested against, Traffic logs were available here: https://pa-us01.api.prismaaccess.com/api/sase/v3.0/resource/query/logviewer/firewall_traffic Threat logs use a similar resource: https://pa-us01.api.prismaaccess.com/api/sase/v3.0/resource/query/logviewe...