session_report.yml

---
# session_report.yml - Generates a report on long sessions.
#
# Description
# ===========
#
# Uses the 'show session all' op command to show sessions older than the `session_min_age` variable.  This playbook
# also uses the JSON output from the `panos_op` module to process the response from the firewall, and the Ansible
# 'template' module to write a report to the current directory.
#
# This playbook requires connection details for the device to be specified in the variables 'ip_address', 'username',
# and 'password'.  These may be defined as host variables (see `host_vars/firewall.yml` for an example) or
# extra vars.
#
# Modules Used
# ============
#
# panos_op - https://paloaltonetworks.github.io/pan-os-ansible/modules/panos_op.html
#
# Usage
# =====
#
#   $ ansible-playbook -i inventory session_report.yml

- hosts: '{{ target | default("firewall") }}'
  connection: local

  vars:
    device:
      ip_address: '{{ ip_address }}'
      username: '{{ username | default(omit) }}'
      password: '{{ password | default(omit) }}'
      api_key: '{{ api_key | default(omit) }}'

    session_min_age: 86400

  tasks:
    - name: Run show session all command
      paloaltonetworks.panos.panos_op:
        provider: '{{ device }}'
        cmd: '<show><session><all><filter><min-age>{{ session_min_age }}</min-age></filter></all></session></show>'
        cmd_is_xml: true
      register: result

    - name: Output list of sessions to file
      ansible.builtin.template:
        src: session_report.j2
        dest: '{{ ip_address }}-{{ ansible_date_time.iso8601 }}-session_report.txt'
        mode: '0644'
      vars:
        sessions: '{{ (result.stdout | from_json).response.result.entry }}'