PANTools
● Cortex XDR 5.1 & XSIAM 3.5  ·  PAN-OS 11.0 – 12.1

Health checks for Cortex and sizing reviews for NGFW.

PANTools is a Dockerized web toolkit for Palo Alto Networks engineers and partners. It runs an API-driven best-practice assessment against any Cortex XDR or XSIAM tenant, and parses a firewall Tech Support File to tell you which hardware model actually fits the traffic you are running.

Run it locally View the source
2
Tools
100+
Policy checks
20
Sizing dimensions
0
Keys stored on disk
Cortex · XDR & XSIAM

Cortex Health & Audit

Point it at a tenant with an API key and it runs a Best Practice Assessment in minutes: platform health on one side, policy and profile configuration on the other. No agent to install, no data leaves your machine.

API-driven Best Practice Assessment

Runs against the Cortex API and XQL. Results are grouped into a System Health Status view and a Policy & Profile Configuration view, each flagged against the recommended baseline.

Cortex XDR 5.1 XSIAM 3.5 Cortex API XQL read-only

Data & ingestion health

  • Unparsed logs — datasets receiving events that no parsing rule is matching.
  • Stale log sources — collectors and Broker VMs that stopped reporting.
  • Non-existent datasets referenced by rules that will never fire.
  • Ingestion volume trends per dataset.

Endpoint & agent estate

  • Disconnected endpoints — agents that have gone quiet.
  • Upgrade loops — agents stuck retrying the same version upgrade.
  • Stale content updates — endpoints behind on content version.
  • Agent version spread across the estate.

Policy & profile baseline

  • Malware profiles — on-write and on-execute examination for PE/DLL, Office macros, scripts, ELF, Mach-O and DMG.
  • Exploit profiles — OS, browser, logical and known-vulnerable-process protection.
  • Behavioral threat protection — ransomware, cryptominers, web shells, reverse shells, container escape, anti-tampering.
  • Agent settings — tamper protection, certificate enforcement, compliance collection, Host Insights.
  • Detection content — BIOCs and correlation rule coverage.
Strata · NGFW

PAN Firewall Mapper

Upload a Tech Support File and get an objective read of what the firewall is really doing — then a model recommendation backed by the published platform datasheet limits, instead of a gut feeling.

Tech Support File analysis & model sizing

Drop in the .tgz from the appliance. The parser extracts the live configuration and usage counters, compares them side by side against the hardware database, and recommends the smallest model that still has headroom.

PAN-OS 11.0 PAN-OS 11.2 PAN-OS 12.1 .tgz TSF offline

Parsed from the TSF

  • Active sessions and concurrent session peaks.
  • Security policies and NAT rules in use.
  • Zones, interfaces in use, virtual routers and vsys layout.
  • External Dynamic Lists — IP, domain and URL entry counts.
  • Address and FQDN objects, ARP table, DHCP servers and relays.
  • GlobalProtect users and decryption rule counts.

Comparison matrix

  • Every parsed value lined up against each candidate platform, column by column.
  • Threat Prevention throughput, connections per second and max sessions per model.
  • Base vsys vs. max vsys, so a multi-tenant design does not get undersized.
  • Base hardware price alongside the technical fit.
  • Sizing database versioned per PAN-OS release.

Output

  • Recommended model — the smallest platform that clears every dimension.
  • Traffic & usage insights — where the current box is actually loaded.
  • Dimensions that fail on a given model are called out explicitly.
  • Useful for refresh conversations, PoV scoping and renewal sizing.
How it works

Four steps, one container

Everything runs inside your own Docker environment. There is no SaaS backend and no telemetry.

01

Bring it up

One docker-compose up and the hub is on localhost.

02

Pick a tool

Cortex Health & Audit for a tenant, PAN Firewall Mapper for an appliance.

03

Feed it input

A Cortex API key and tenant URL, or the firewall Tech Support File.

04

Read the findings

Grouped results with the recommended baseline next to the current state.

Install

Quick start

Requires Docker and Docker Compose on the host. Nothing else.

bash 
# clone and build
$ git clone https://github.com/davidpm84/PANTools.git
$ cd PANTools
$ docker-compose up -d --build

# then open the hub
$ open http://localhost
  • Runs entirely local. Everything stays inside your Docker environment — no external cloud dependency.
  • Cortex API keys are held in memory only and are never written to disk.
  • Read-only by design. The audit queries the tenant; it does not change policy for you.
  • Two editions. Partner Edition uses a shared password; SE Edition authenticates with a GitHub PAT.
Disclaimer. PANTools is a community-driven toolkit for educational and operational assistance. It is not an official Palo Alto Networks product and is not supported by Palo Alto Networks. Always validate configuration changes and API calls in a non-production environment first. Product names and trademarks belong to their respective owners.