• RISK
  • THREAT
  • REMEDIATION
  • HUMAN

How to audit security policies with your AI

Connect your agent to PAN-OS to scan for configuration gaps and active threats. It handles the data gathering so you can focus on remediation.

Ask AI about this page

Short answer

How can I audit my security policies using AI?

Your agent pulls security rules and threat logs directly from PAN-OS to spot overly permissive access or active threats. You get a clear view of your security posture without manual log digging. This breakdown shows how to run those checks.

Audit outcomes

Where your findings land.

The AI organizes its findings into these specific categories.

RISK

Permissive rule alerts

The AI identifies rules that are too broad. You get a list of specific access points that need tightening.

THREAT

Active threat detection

The agent flags recent entries in the threat logs. You see exactly which IPs or signatures are hitting your perimeter.

REMEDIATION

Cleanup suggestions

The AI suggests how to fix identified gaps. You decide which rules to prune or restrict.

HUMAN

Manual policy review

The AI flags complex logic that requires a person. You step in to handle high-stakes policy changes.

The workflow

What your AI does when the audit starts.

The AI acts as your data gatherer and analyst.

  1. Pulling rules

    The agent pulls your current security configuration to check for wide-open access or outdated rules.

    get_security_rules

  2. Scanning logs

    The agent pulls recent threat logs to see if any blocked or allowed traffic matches known attack patterns.

    get_threat_logs

  3. Identifying gaps

    The AI compares the rules against the threat data to find where permissive rules might be letting bad traffic through.

    get_security_rulesget_threat_logs

  4. Reporting

    The agent summarizes the most critical risks and presents them in your chat interface.

    get_threat_logs

Try it

Copy these to start.

Use these prompts to kick off an audit.

Starting points

These are starting points. Replace the bracketed text with your specific firewall or zone names.

PAN-OS Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_83HmcpYgcle8KqQOcz9GWLbtyUqjN3KZeuMd25f4/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — PAN-OS capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "pan-os-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_83HmcpYgcle8KqQOcz9GWLbtyUqjN3KZeuMd25f4/mcp"
    }
  }
}
Copy into chat04

  • Show me all security rules that allow traffic from any source to my database zone.

  • Check my threat logs for any suspicious activity from the last 24 hours.

  • Are there any overly permissive rules that correlate with recent threat logs?

  • List all security rules that haven't seen traffic in the last 30 days.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect PAN-OS once, then ask.

Add your credentials once. Your login stays encrypted, and you can immediately start asking your agent about your security posture.

Connect PAN-OS to your AI

FAQ

How the audit behaves

  • 01

    Can the AI change my security rules?

    No. The AI can only read rules and logs. You must manually make any changes in your PAN-OS management console.

  • 02

    Does the AI delete any logs?

    No. The AI has read-only access to your threat logs.

  • 03

    Can I audit specific zones?

    Yes. You can ask the AI to focus its rule and log analysis on specific zones or IP ranges.

  • 04

    How does the AI see my threats?

    The AI uses the threat logs to identify patterns and active security events.

  • 05

    Can the AI fix a misconfigured rule automatically?

    No. The AI identifies the issue and suggests a fix, but you are the only one who can apply it.

  • More questions about PAN-OS? The Connector page answers them. See everything the PAN-OS Connector can do

Connect PAN-OS to Claude, Cursor, ChatGPT & more