pan-os-edit-rule command: Added support for removing and adding group profile settings

Packs/PAN-OS/Integrations/Panorama/Panorama.py

@@ -3748,7 +3748,7 @@ def panorama_get_current_element(element_to_change: str, xpath: str, is_commit_r
 
 @logger
 def panorama_edit_rule_items(rulename: str, element_to_change: str, element_value: List[str], behaviour: str):
-    listable_elements = ['source', 'destination', 'application', 'category', 'source-user', 'service', 'tag']
+    listable_elements = ['source', 'destination', 'application', 'category', 'source-user', 'service', 'tag', 'profile-setting']
     if element_to_change not in listable_elements:
         raise Exception(f'Adding objects is only available for the following Objects types:{listable_elements}')
     if element_to_change == 'target' and not DEVICE_GROUP:
@@ -3767,35 +3767,44 @@ def panorama_edit_rule_items(rulename: str, element_to_change: str, element_valu
             params['xpath'] = XPATH_SECURITY_RULES + PRE_POST + '/security/rules/entry' + '[@name=\'' + rulename + '\']'
     else:
         params['xpath'] = XPATH_SECURITY_RULES + '[@name=\'' + rulename + '\']'
-    params["xpath"] = f'{params["xpath"]}/{element_to_change}'
 
-    current_objects_items = panorama_get_current_element(element_to_change, params['xpath'])
-    if behaviour == 'add':
-        values = list((set(current_objects_items)).union(set(element_value)))
-    else:  # remove
-        values = [item for item in current_objects_items if item not in element_value]
-        if not values:
-            raise Exception(f'The object: {element_to_change} must have at least one item.')
+    if element_to_change == 'profile-setting':
+        params['action'] = 'set'
+        params['element'] = '<profile-setting><group/></profile-setting>'
+        http_request(URL, 'POST', body=params)
+        return_results(f'Rule edited successfully.')
 
-    params['element'] = add_argument_list(values, element_to_change, True)
-    result = http_request(URL, 'POST', body=params)
-    rule_output = {
-        'Name': rulename,
-        SECURITY_RULE_ARGS[element_to_change]: values
-    }
-    if DEVICE_GROUP:
-        rule_output['DeviceGroup'] = DEVICE_GROUP
+    else:
+        params["xpath"] = f'{params["xpath"]}/{element_to_change}'
 
-    return_results({
-        'Type': entryTypes['note'],
-        'ContentsFormat': formats['json'],
-        'Contents': result,
-        'ReadableContentsFormat': formats['text'],
-        'HumanReadable': 'Rule edited successfully.',
-        'EntryContext': {
-            "Panorama.SecurityRule(val.Name == obj.Name)": rule_output
+        current_objects_items = panorama_get_current_element(element_to_change, params['xpath'])
+        if behaviour == 'add':
+            values = list((set(current_objects_items)).union(set(element_value)))
+        else:  # remove
+            values = [item for item in current_objects_items if item not in element_value]
+            if not values:
+                raise Exception(f'The object: {element_to_change} must have at least one item.')
+
+        params['element'] = add_argument_list(values, element_to_change, True)
+        result = http_request(URL, 'POST', body=params)
+
+        rule_output = {
+            'Name': rulename,
+            SECURITY_RULE_ARGS[element_to_change]: values
         }
-    })
+        if DEVICE_GROUP:
+            rule_output['DeviceGroup'] = DEVICE_GROUP
+
+        return_results({
+            'Type': entryTypes['note'],
+            'ContentsFormat': formats['json'],
+            'Contents': result,
+            'ReadableContentsFormat': formats['text'],
+            'HumanReadable': 'Rule edited successfully.',
+            'EntryContext': {
+                "Panorama.SecurityRule(val.Name == obj.Name)": rule_output
+            }
+        })
 
 
 def build_audit_comment_params(
@@ -3827,6 +3836,8 @@ def panorama_edit_rule_command(args: dict):
         raise Exception('The target argument is relevant only for a Palo Alto Panorama instance.')
 
     behaviour = args.get('behaviour') if 'behaviour' in args else 'replace'
+    # in this case of profile-setting add is the same as replace
+    behaviour = 'replace' if element_to_change == 'profile-setting' and behaviour == 'add' else behaviour
     if behaviour != 'replace':
         panorama_edit_rule_items(rulename, element_to_change, argToList(element_value), behaviour)
     else:

Packs/PAN-OS/ReleaseNotes/1_17_8.md

@@ -0,0 +1,6 @@
+
+#### Integrations
+
+##### Palo Alto Networks PAN-OS
+
+- Added support for removing and adding group profile settings in the ***pan-os-edit-rule*** command.

Packs/PAN-OS/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "PAN-OS by Palo Alto Networks",
     "description": "Manage Palo Alto Networks Firewall and Panorama. Use this pack to manage Prisma Access through Panorama. For more information see Panorama documentation.",
     "support": "xsoar",
-    "currentVersion": "1.17.7",
+    "currentVersion": "1.17.8",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",