# Palo Alto Firewall Analyzer · PAN-OS

> Analyze Palo Alto PAN-OS security policies, NAT, decryption policies, and objects resolved to protocol/port, plus IPSec/GlobalProtect/SSL-VPN, in one self-hosted dashboard.

Last updated: June 2026

Reads PAN-OS directly over the XML API, read-only:

- **Security policies**, **NAT**, and **decryption policies**.
- **Objects** resolved recursively to the real protocols and ports ("service-https (tcp/443)", not a bare object name).
- **VPNs**: IPSec tunnels, IKE gateways, GlobalProtect, and SSL-VPN sessions.
- **Change detection** commit-correlated to the admin who made each change.
- **Policy Analyzer**: effective access, rule hygiene, and per-rule risk scoring.

Configuration state, not logs.

## SAMURAI vs Palo Alto log analyzers

| | SAMURAI | Palo Alto log analyzers |
|---|---|---|
| Data source | PAN-OS configuration read from the firewall | Traffic, threat, and system logs |
| Question answered | What is the policy, and who committed what, when? | What traffic or threats were seen? |
| Scope | Palo Alto plus FortiGate, Cisco, Juniper SRX, routers, switches, ACI, ISE, vCenter | Usually Palo Alto logs only |
| Deployment | Single self-hosted Docker container, air-gap friendly | Log collector, SIEM, or SaaS pipeline |

## Frequently asked questions

### How does SAMURAI read Palo Alto?

Over the PAN-OS XML API, read-only: security policies, NAT, decryption policies, address and service objects, and VPN configuration. No agent and no changes to the firewall.

### Does it resolve Palo Alto service and address objects?

Yes. Predefined, custom, and grouped services are resolved recursively at sync time and shown with their protocol and port, for example "service-https (tcp/443)", so you are not chasing object names.

### Is this a Palo Alto log analyzer?

No, SAMURAI analyzes PAN-OS configuration state, not logs. For traffic and threat-log analytics, a SIEM or log tool is the right choice; SAMURAI focuses on the policy and its changes.

### Can it attribute Palo Alto policy changes to an admin?

Yes. Changes are detected from real device state and grouped by PAN-OS commit, so each change is tied to the commit and the administrator who made it, without relying on the audit log.

### Is there a free tier to evaluate?

Yes. A free test license ships with the SAMURAI Docker image on Docker Hub, no email required, so you can point it at your own Palo Alto firewall before talking to anyone.

---

Canonical page: https://nometa.az/en/palo-alto-firewall-analyzer/
Part of SAMURAI, a self-hosted, multi-vendor network monitoring & security platform. Overview: https://nometa.az/llms.txt
Contact: info@nometa.az · Docker Hub: https://hub.docker.com/r/beyrak44/samurai