A Palo Alto firewall analyzer that reads PAN-OS directly.
SAMURAI is a self-hosted Palo Alto firewall analyzer. It reads PAN-OS configuration through the XML API: security rules, NAT and decryption policy, address and service objects, and VPN tunnels. Changes are grouped by commit, so each diff comes with the admin who committed it, right next to your FortiGate and Cisco firewalls.
Updated June 2026
What it reads from Palo Alto
Security rules
Search the whole rulebase by zone, address, service or action, across every Palo Alto firewall you’ve added.
NAT and decryption policy
Source and destination NAT and SSL/TLS decryption rules, with address objects shown as the IPs they stand for.
Services you can read
Predefined, custom and grouped services are resolved, so a rule says “service-https (tcp/443)” and not just an object name.
VPN in context
IPsec tunnels, IKE gateways, GlobalProtect and SSL-VPN sessions, beside the rules that govern them.
Changes by commit
SAMURAI detects changes from device state and groups them by PAN-OS commit, so each diff points to the commit and the admin behind it. It doesn’t rely on the audit log.
The rest of the network
Palo Alto sits beside FortiGate, Cisco FMC/FTD, routers, switches, ACI, ISE and vCenter in one searchable dashboard.
How it compares to Palo Alto log analyzers
Tools that read Palo Alto traffic and threat logs tell you what happened on the wire. SAMURAI reads the PAN-OS configuration (the rules, objects and NAT) and tracks every change to it.
Data source
SAMURAI
PAN-OS configuration, read from the firewall
Palo Alto log analyzers
Traffic, threat and system logs
Question it answers
SAMURAI
What’s the policy, and who committed what?
Palo Alto log analyzers
What traffic or threats were seen?
Scope
SAMURAI
Palo Alto plus FortiGate, Cisco, routers, switches, ACI, ISE and vCenter
Palo Alto log analyzers
Usually Palo Alto logs only
Deployment
SAMURAI
One self-hosted Docker container, works air-gapped
Palo Alto log analyzers
Log collector, SIEM or SaaS pipeline
For traffic and threat analytics, use a SIEM or a log analyzer. For PAN-OS policy visibility, resolved objects and commit-level change history across Palo Alto and the rest of your network, use SAMURAI.
Frequently asked questions
How does SAMURAI read Palo Alto?
Through the PAN-OS XML API, read-only. It pulls security rules, NAT, decryption policy, address and service objects, and VPN configuration. There’s no agent, and nothing on the firewall changes.
Does it resolve Palo Alto service and address objects?
Yes. Predefined, custom and grouped services are resolved when SAMURAI syncs and shown with protocol and port, for example “service-https (tcp/443)”.
Is this a Palo Alto log analyzer?
No. SAMURAI reads PAN-OS configuration, not logs. For traffic and threat analytics, use a SIEM or log tool. SAMURAI covers the policy and its changes.
Can it attribute Palo Alto policy changes to an admin?
Yes. Changes are detected from device state and grouped by PAN-OS commit, so each one is tied to the commit and the admin who made it, without reading the audit log.
Is there a free tier to evaluate?
Yes. A free test license ships with the Docker image, no email needed, so you can point it at your own Palo Alto firewall before you talk to us.
How is it installed?
One container on a VM that can reach the firewall’s management interface. Expect data in about five minutes.