PaloAltoNetworks / PaloAltoNetworks/pan-os-python

Unable to get the hit_count from Panorama pre/post rules

Open
#598 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
400
Forks
199
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

Unable to get the hit_count from Panorama pre/post rules using RuleBaseHitCount with all_rules=True

Expected behavior

API should return a dictionary with rule_name as key and HitCount object with hit_count populated.

Current behavior

hit_count under HitCount Object for security rule is coming as None

Possible solution

Need to evaluate RuleBaseHitCount.refresh() API

Steps to reproduce

My sample code:

def fetch_panorama_rules_with_hit_counts(panorama_ip, api_key, device_group_name):
    # Connect to Panorama
    panorama = Panorama(hostname=panorama_ip, api_key=api_key)

    # Create and add device group
    dg = DeviceGroup(name=device_group_name)
    panorama.add(dg)

    # Add rulebase to the device group
    rulebase = PreRulebase()
    try:
        dg.add(rulebase)
    except Exception as e:
        print(f"Error while adding rulebase: {e}")
        return []
    info = rulebase.opstate.hit_count.refresh("security", all_rules=True)
    print(vars(info["amruta-pre-rule"]))

Screenshots

Sample Output:

{'obj': <SecurityRule amruta-pre-rule 0x71e341076170>, 'name': 'None', 'latest': None, 'hit_count': None, 'last_hit_timestamp': None, 'last_reset_timestamp': None, 'first_hit_timestamp': None, 'rule_creation_timestamp': 1750751413, 'rule_modification_timestamp': 1751350485}

On the other hand from CLI , i can see the hit count

show rule-hit-count device-group IoT_Firewalls pre-rulebase security rules all

Rule Name                                                         Rule usage          Device Name                         Vsys         Hit Count       Last Hit Timestamp            Last Reset Timestamp          First Hit Timestamp           Rule Create Timestamp        Rule Modify Timestamp         Last Received Update Timestamp          Device State     
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
amruta-pre-rule                                                  
                                                                  Used                PANW-BR2                            vsys1        320627          Wed Jul  2 04:49:39 2025      -                            Mon Jun 30 23:19:30 2025      Tue Jun 24 00:52:26 2025      Mon Jun 30 23:16:24 2025      Wed Jul  2 04:50:25 2025                connected        
Total Hit Count:     320627    

Context

we are unable fetch the rules from panorama who are using our DAG

Your Environment

  • Version used:
  • Software version:11.2.4-h2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with RuleBaseHitCount.refresh(), using the provided Panorama and PreRulebase reproduction with all_rules=True. Compare its returned HitCount fields with the CLI output for the pre-rule security rule. Done means the returned dictionary contains the rule name and a populated hit_count matching the available Panorama data.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.