Querying Palo Alto Strata Logging Service (SLS) Traffic and Threat Logs with Python
I was recently told that querying Palo Alto Networks Strata Logging Service (SLS) directly through an API was not possible. I also found a few Reddit threads and older examples that pointed toward the legacy Cortex Data Lake APIs, but after spending some time with the Strata Cloud Manager Log Viewer and Chrome Developer Tools, it turns out that raw Traffic and Threat logs can be queried programmatically. The important caveat is that I have not found public Palo Alto documentation for the specific Log Viewer resources used below. The API is clearly being used by the Strata Cloud Manager UI, though, and it works with the normal service-account OAuth flow. API Endpoints For the US tenant I tested against, Traffic logs were available here: https://pa-us01.api.prismaaccess.com/api/sase/v3.0/resource/query/logviewer/firewall_traffic Threat logs use a similar resource: https://pa-us01.api.prismaaccess.com/api/sase/v3.0/resource/query/logviewe...