[READ-ONLY] Lists all configured firewall targets. Shows names and hosts (never API keys). Indicates whether the 'firewall' parameter is required for other tools.

[READ-ONLY] Retrieves system information (hostname, model, serial, software version) from the PanOS firewall. Executes: show system info.

[READ-ONLY] Retrieves high-availability (HA) state and peer information from the firewall. Executes: show high-availability state.

[READ-ONLY] Retrieves active session count and summary from the firewall. Executes: show session info.

[READ-ONLY] Retrieves system resource utilization including CPU, memory, and disk usage. Executes: show system resources.

[READ-ONLY] Retrieves all network interfaces with their status, IP addresses, and configuration. Executes: show interface all.

[READ-ONLY] Retrieves all security zones configured on the firewall. Reads config at: /config/.../vsys/entry/zone.

[READ-ONLY] Retrieves the current routing table from the firewall. Executes: show routing route.

[READ-ONLY] Retrieves ARP table entries from the firewall. Executes: show arp entry all.

[READ-ONLY] Retrieves VLAN configuration from the firewall. Reads config at: /config/.../network/vlan.

[READ-ONLY] Retrieves DHCP server lease information. Executes: show dhcp server lease all.

[READ-ONLY] Retrieves DNS proxy configuration. Reads config at: /config/.../network/dns-proxy.

[READ-ONLY] Retrieves static routes from a virtual router. Reads config at: /config/.../virtual-router/entry/routing-table/ip/static-route.

[READ-ONLY] Retrieves all security policy rules from the firewall. Reads config at: /config/.../rulebase/security/rules.

[READ-ONLY] Retrieves security profiles including antivirus, vulnerability, spyware, and URL filtering profiles. Reads config at: /config/.../vsys/entry/profiles.

[READ-ONLY] Retrieves security profile groups that combine multiple security profiles. Reads config at: /config/.../vsys/entry/profile-group.

[READ-ONLY] Retrieves policy-based forwarding (PBF) rules. Reads config at: /config/.../rulebase/pbf/rules.

[READ-ONLY] Retrieves DoS protection profiles. Reads config at: /config/.../profiles/dos-protection.

[READ-ONLY] Retrieves QoS policy rules. Reads config at: /config/.../rulebase/qos/rules.

[READ-ONLY] Retrieves all address objects (IP addresses, ranges, FQDNs) defined on the firewall. Reads config at: /config/.../vsys/entry/address.

[READ-ONLY] Retrieves all address groups that contain multiple address objects. Reads config at: /config/.../vsys/entry/address-group.

[READ-ONLY] Retrieves all service objects (port/protocol definitions) from the firewall. Reads config at: /config/.../vsys/entry/service.

[READ-ONLY] Retrieves all service groups that contain multiple service objects. Reads config at: /config/.../vsys/entry/service-group.

[READ-ONLY] Retrieves application filters used for application-based policy rules. Reads config at: /config/.../vsys/entry/application-filter.

[READ-ONLY] Retrieves all tags defined on the firewall. Reads config at: /config/.../vsys/entry/tag.

[READ-ONLY] Retrieves all NAT policy rules including source NAT, destination NAT, and bidirectional rules. Reads config at: /config/.../rulebase/nat/rules.

[READ-ONLY] Retrieves IP-to-user mappings from User-ID, showing which users are mapped to which IP addresses. Executes: show user ip-user-mapping all.

[READ-ONLY] Retrieves user groups known to the firewall via User-ID. Executes: show user group list.

[READ-ONLY] Retrieves User-ID configuration settings including agent configuration and group mapping. Reads config at: /config/.../vsys/entry/user-id-agent.

[READ-ONLY] Retrieves all administrator accounts configured on the firewall. Reads config at: /config/mgt-config/users.

[READ-ONLY] Retrieves administrator role definitions and their permissions. Reads config at: /config/.../vsys/entry/admin-role.

[READ-ONLY] Retrieves authentication profiles including RADIUS, LDAP, and TACACS+ configurations. Reads config at: /config/shared/authentication-profile.

[READ-ONLY] Retrieves IPSec VPN tunnel status and security associations. Executes: show vpn ipsec-sa.

[READ-ONLY] Retrieves currently connected GlobalProtect VPN users. Executes: show global-protect-gateway current-user.

[READ-ONLY] Retrieves GlobalProtect gateway and portal configuration. Reads config at: /config/.../vsys/entry/global-protect.

[READ-ONLY] Retrieves all firewalls managed by Panorama with their connection status. Executes: show devices all.

[READ-ONLY] Retrieves all device groups configured in Panorama. Reads config at: /config/.../device-group.

[READ-ONLY] Retrieves all templates configured in Panorama. Reads config at: /config/.../template.

[READ-ONLY] Retrieves all template stacks configured in Panorama. Reads config at: /config/.../template-stack.

[READ-ONLY] Retrieves shared address objects defined at Panorama level. Reads config at: /config/shared/address.

[READ-ONLY] Retrieves shared address groups defined at Panorama level. Reads config at: /config/shared/address-group.

[READ-ONLY] Retrieves shared service objects defined at Panorama level. Reads config at: /config/shared/service.

[READ-ONLY] Retrieves shared service groups defined at Panorama level. Reads config at: /config/shared/service-group.

[READ-ONLY] Retrieves pre-rules from a device group (rules pushed before local firewall rules). Reads config at: /config/.../device-group/entry/pre-rulebase/security/rules.

[READ-ONLY] Retrieves post-rules from a device group (rules pushed after local firewall rules). Reads config at: /config/.../device-group/entry/post-rulebase/security/rules.

[READ-ONLY] Retrieves NAT rules from a device group (pre or post rulebase). Reads config at: /config/.../device-group/entry/{pre|post}-rulebase/nat/rules.

[READ-ONLY] Retrieves log collector configuration and status from Panorama. Executes: show log-collector all.

[READ-ONLY] Retrieves collector group configuration from Panorama. Reads config at: /config/.../log-collector-group.

[READ-ONLY] Retrieves the status of the last configuration push to managed devices. Executes: show config push status.

[READ-ONLY] Retrieves the status of pending commits in Panorama. Executes: show jobs all.

[READ-ONLY] Retrieves software and content versions on all managed firewalls. Executes: show devices all.

[READ-ONLY] Retrieves Panorama high-availability status for Panorama HA pairs. Executes: show high-availability state.

[READ-ONLY] Retrieves the device group hierarchy showing parent-child relationships. Reads config at: /config/readonly/.../device-group.

[READ-ONLY] Retrieves shared security profiles defined at Panorama level. Reads config at: /config/shared/profiles.

[READ-ONLY] Retrieves shared security profile groups defined at Panorama level. Reads config at: /config/shared/profile-group.

[READ-ONLY] Retrieves recent traffic logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.

[READ-ONLY] Retrieves recent threat logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.

[READ-ONLY] Retrieves recent system logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.

[READ-ONLY] Retrieves recent configuration change logs from the firewall using the PanOS log API (type=log). Supports filtering by query and limiting result count.

[READ-ONLY] Retrieves recent URL filtering logs from the firewall using the PanOS log API (type=log&log-type=url). Shows URLs visited and actions taken (allow/block/continue/override) by URL filtering policy.

[READ-ONLY] Retrieves WildFire cloud connection status and statistics. Executes: show wildfire status.

[READ-ONLY] Retrieves current antivirus, threat, and WildFire signature versions and release dates. Executes: show system info (extracts signature fields).

[READ-ONLY] Retrieves available content update versions (antivirus, applications, threats). Executes: request content upgrade info.

[READ-ONLY] Retrieves predefined URL filtering categories. Reads config at: /config/predefined/pan-url-categories.

[READ-ONLY] Retrieves SSL/TLS certificates configured on the firewall. Reads config at: /config/shared/certificate.

[READ-ONLY] Retrieves SSL decryption policy rules. Reads config at: /config/.../rulebase/decryption/rules.

[READ-ONLY] Retrieves SSL decryption profiles. Reads config at: /config/.../profiles/decryption.

[READ-ONLY] Retrieves license status and expiration dates for all features. Executes: request license info.

[READ-ONLY] Retrieves license usage information including VM model, serial, capacity tier, and mode. Executes: show system info (extracts license fields).

[READ-ONLY] Retrieves configuration at a specific XPath location. This is a flexible read tool for querying any part of the PanOS configuration tree.

[READ-ONLY] Lists firewalls managed by Panorama: hostname, serial, IP, model, version, connection and policy/template sync state. Use the hostname or serial as 'device' in other tools.

[READ-ONLY] Lists device groups with their parent chain and member firewalls (hostname, serial, connected). Policies of a device group include everything inherited from shared and its parents.

[READ-ONLY] Searches logs stored on Panorama (traffic, threat, url, wildfire, data, globalprotect, userid, auth, decryption, system) with structured filters and a time window. Returns trimmed entries, each with a '_why' explanation of what blocked it. Structured filters are server-side for traffic/threat/url/wildfire/data/decryption; for other types user and src_ip are matched locally.

[READ-ONLY] User-ID state on a managed firewall: which user is mapped to an IP (show user ip-user-mapping) and/or which groups a user belongs to (show user user-ids match-user). A missing mapping means user/group-based rules cannot match that IP.

[READ-ONLY] GlobalProtect users currently connected to a gateway firewall (show global-protect-gateway current-user), optionally for one user.

[READ-ONLY] Asks a managed firewall which security rule matches a flow (test security-policy-match). This is the ground truth, including local rules invisible from Panorama. Include source_user so user/group-based rules are evaluated.

[READ-ONLY] Asks a managed firewall how it categorizes a URL (test url): PAN-DB categories from the local cache and the cloud. Custom categories are not shown here: use url_category_find.

[READ-ONLY] Active sessions on a managed firewall matching a filter (show session all filter). Useful while the user reproduces the issue.

[READ-ONLY] Searches security or decryption rules (pre/post) in Panorama's running config. Matches 'contains' against rule name, zones, addresses, users, applications, services, categories, tags and description. With 'device_group', rules of that group AND everything it inherits (shared, parent groups) are returned in evaluation order; with 'device', only rules applying to that firewall. Output flags rules without log forwarding.

[READ-ONLY] Checks whether an IP, domain or URL is present in the External Dynamic Lists applying to a firewall (config from Panorama, current content from the firewall), including EDL exception lists.

[READ-ONLY] Runs an arbitrary read-only operational command (root element must be or ) on Panorama, or on a managed firewall with 'device'. Use when no dedicated tool exists.

[READ-ONLY] Lists custom URL categories (shared and device groups) with their type and number of entries. Use url_category_get for the entries.

[READ-ONLY] Returns the entries of a custom URL category (URL list, or PAN-DB categories for 'Category Match'). Searches shared and every device group unless device_group is set.

[READ-ONLY] Finds which existing custom URL categories already cover a URL (PAN-OS wildcard/prefix rules), which ones contain the same domain but do not match (pattern issue), and with 'device' the PAN-DB category. Run this BEFORE proposing any new URL category.

[READ-ONLY] Shows where URL categories are used: security/decryption rules referencing them (in evaluation order when 'device' is set) and URL filtering profiles acting on them, with the rules using those profiles.

[READ-ONLY] START HERE for a ticket. Builds a timeline of everything that blocked a user or source IP across traffic, threat, URL, WildFire, data filtering, decryption and GlobalProtect logs, grouped and explained (which layer blocked, why, what to check next). With reported_url, flags blocks on OTHER domains at the same time (upload/storage/CDN/SSO dependencies of the site).

[READ-ONLY] Full analysis of why a URL is blocked/allowed: existing custom categories covering it (or same-domain entries that do not match), PAN-DB category, rules and URL filtering profiles using those categories, recent URL logs for the user, and conclusions. Prevents proposing a category that already exists.

[READ-ONLY] Analyzes a threat/file block (antivirus, WildFire, anti-spyware, vulnerability, file blocking, data filtering): finds the log, the rule and the security profile actually applied (profile group resolved), whether an exception for that threat ID ALREADY exists (in the applied profile or elsewhere), the matching file-blocking rule, and the WildFire verdict.

[READ-ONLY] Analyzes a flow (source -> destination:port) on a firewall: User-ID mapping and groups of the source, rule the firewall actually matches (test security-policy-match with the user), rules allowing the requested application, and recent traffic logs explained. Use for 'no rule allows X', upload app functions, App-ID or network issues.

[READ-ONLY] Call this FIRST when the user shares a support ticket or asks to debug a blocked user: returns the diagnosis method, the rules to follow and the expected answer format.

[READ-ONLY] Returns the troubleshooting playbook: visibility pitfalls, third-party dependencies, URL filtering, file/threat false positives, App-ID, User-ID, NAT, decryption, DNS security, EDL, zone protection. Read it when the cause is unclear or before concluding.