moshekaplan / palo_alto_firewall_analyzer

Python scripts for reviewing Palo Alto Firewall configurations
Creative Commons Zero v1.0 Universal
25 stars 8 forks source link

Support JSON output #54

Open moshekaplan opened 1 year ago

moshekaplan commented 1 year ago

Support generating JSON output, instead of only text-based. JSON should (ideally) include:

Nawtest commented 7 months ago

It would be interesting to add the quantity of analyzed elements to create custom KPIs. Did you have any specific method in mind to accomplish this?

moshekaplan commented 7 months ago

It would be interesting to add the quantity of analyzed elements to create custom KPIs. Did you have any specific method in mind to accomplish this?

Nope, although if I'm understanding correctly, it would seem that those sorts of aggregate queries would best be moved into a separate 'reporting' module, so that reporting (and each report) would be independent of everything else.

Nawtest commented 7 months ago

No, what I want is to extract the totals from the analyzed information so that every person using the tool can utilize them to implement the necessary KPIs. Not calculate the KPIs within the tool itself.

moshekaplan commented 7 months ago

Could you give any examples of what totals you'd want to extract?

Nawtest commented 7 months ago

I was thinking of something like this:

image

Nawtest commented 7 months ago

And in txt file: image

Nawtest commented 7 months ago

I have been modifying the JSON output to be able to exploit the data a bit more, I'll show you an image.

image

The idea is to add another parameter "--detail" to break down the text info.

moshekaplan commented 7 months ago

Apologies for the delayed response.

I like the idea, but my only concern is that it's not immediately clear what the fractions represent. Especially as some policies or objects are complex enough that a single object could have multiple failures. (e.g., a rule with a non-resolving FQDN can have entries in the source, destination, or both)

Nawtest commented 7 months ago

Don't worry, yes, I understand your concern. For now, I'm handling the simple ones. When I get to those types of rules, I guess I'll have to restructure the detail output. Let's see how it goes...