pan-os-php command builder and cleanup guide: Jesse A. Green

80command types in the matrix

526actions across 33 config types

1,098filter operators

372named ranges in the rebuilt workbook

Status board

3 working, 1 designed only, 3 failed or missed

Working 3

Command matrix: 80 command types; 33 config types carry 526 actions and 1,098 filter operators.
Oct 2026 workbook rebuild from the matrix: clean exit, 11 sheets, 372 named ranges.
A 41 KB cleanup guide (rules first, then overrides, objects and tags) ending in a 19-row table that cites source files and lines.

Designed only 1

No recorded use on a real exported config yet.

Failed or missed 3

The README still names an older sheet; the builder expects the exported config to be named after the Panorama.
The guide's line citations were not re-checked against the latest upstream; it assumes Panorama's default object precedence.
Two orphan entries in the extracted matrix are still unassigned.

Problem

pan-os-php is an open-source, community-supported toolkit for bulk PAN-OS and Panorama config work; it is published in the PaloAltoNetworks GitHub org, and current releases come from its maintainer's fork. It lists actions and filters per type, but valid combinations and argument details mostly live in the source. Building a correct command by hand is slow, and an unused-object cleanup done in the wrong order can break rules.

What I built

A parser that reads the pan-os-php source and extracts a command matrix: 80 command types, of which 33 config types (objects, rules, network and device) carry 526 actions and 1,098 filter operators; the other 47 are stand-alone utilities. It is pinned to one upstream release (extracted Apr 2026).
An Excel builder with no macros for the 33 config types. Cascading dropdowns (type, action, arguments, filter) assemble a complete command line.
A 41 KB cleanup guide (rules first, then overrides, objects and tags) that ends with a 19-row table citing source files and lines.

Example output ("show unused address objects"), placeholder names:

pan-os-php in=pano-lab.xml location=DG-Example template=any type=address 'actions=display' 'filter=(object is.unused.recursive)' out=Pan_pano-lab_DG-Example_any_address_unused.xml

The pan-os-php Command Builder workbook: cascading dropdowns for type, action, arguments and filter, with the assembled command in a cell below; placeholder names only — Figure 1pan-os-php Command Builder: cascading dropdowns for type, action, arguments and filter produce a complete pan-os-php command. Placeholder names only. Full size, 1,600 px

How AI was used

AI agents wrote the parser, the workbook generator and the guide (April 2026; current builder July 2026). I picked the problem from field work. The model used for those sessions is not on record.

Results

In Oct 2026 the workbook was rebuilt from the matrix in a temp copy (an AI evidence task): clean exit, 11 sheets, 372 named ranges. The address type alone has 57 actions and 111 unique filter expressions.

The cleanup playbook is in the guide library: pan-os-php cleanup of unused objects.

Status and limits

Working build, small, pinned to one upstream release (extracted Apr 2026). The README still names an older sheet, the builder expects the exported config to be named after the Panorama, and I have no recorded use on a real config yet. The guide assumes Panorama's default object precedence (descendant objects win); its line citations were not re-checked against the latest upstream.

What I learned

Parsing the tool's own source gave a map that follows the code rather than the docs (two orphan entries are still unassigned), and the guide's key steps point to the source behind them.