Dry Run When Applying Actions

[hodgiers]

For a filter and action like this:

'filter=((to has INSIDE) and (from has OUTSIDE) and (secprof group.is 'Alert-Only'))' actions=securityProfile-Group-Set:Block-High-Crit

Is there a flag or option that essentially acts as a dry-run?

The way I "dry-run" now is run the filter with no action to check matches against the filter and then run the same filter with the action applied. For fairly complex filters/actions it gets a bit tedious managing that process hence my question.

For example:
Something like:

'filter=((to has INSIDE) and (from has OUTSIDE) and (secprof group.is 'Alert-Only'))' actions=securityProfile-Group-Set:Block-High-Crit --dry-run

where I still get the:

passing through Action='securityProfile-Group-Set'

output but it doesn't actually make the changes.

OR even something like appending --dry-run simply runs the command as though no actions are applied.
So that

'filter=((to has INSIDE) and (from has OUTSIDE) and (secprof group.is 'Alert-Only'))' actions=securityProfile-Group-Set:Block-High-Crit --dry-run

Looks like:

'filter=((to has OUTSIDE) and (from has OUTSIDE) and (secprof group.is 'Alert-Only'))'

When the command is run. Makes it so that I'm only removing the flag rather than having to add/remove/manage entire actions.

Search Indexing help(ignore):
dry run
dryrun

[swaschkut]

sorry to answer late,

What you can use a try run is to work on an offline config file:

pan-os-php type=upload in=api://MGMT-IP out=start_config.xml

offline mode:
pan-os-php type=rule 'filter=((to has INSIDE) and (from has OUTSIDE) and (secprof group.is Alert-Only))' 'actions=securityProfile-Group-Set:Block-High-Crit' in=start_config.xml out=manipulate.xml

API mode:
pan-os-php type=rule 'filter=((to has INSIDE) and (from has OUTSIDE) and (secprof group.is Alert-Only))' 'actions=securityProfile-Group-Set:Block-High-Crit' in=api://MGMT-IP

with the offline mode you can also directly display the changes:
pan-os-php type=diff file1=start_config.xml file2=manipulate.xml

Adding another Flag like dry-run is not yet planned