File Blocking Profile Models¶

Overview¶

The File Blocking Profile models provide a structured way to manage file blocking profiles in Palo Alto Networks' Strata Cloud Manager. These models support defining file blocking rules with actions, applications, directions, and file types to control file transfers. Profiles can be defined in folders, snippets, or devices. The models handle validation of inputs and outputs when interacting with the SCM API.

Models¶

The module provides the following Pydantic models:

FileBlockingProfileBaseModel: Base model with fields common to all profile operations
FileBlockingProfileCreateModel: Model for creating new file blocking profiles
FileBlockingProfileUpdateModel: Model for updating existing file blocking profiles
FileBlockingProfileResponseModel: Response model for file blocking profile operations
FileBlockingRule: Model for individual file blocking rules within a profile

All models use extra="forbid" configuration, which rejects any fields not explicitly defined in the model.

Model Attributes¶

FileBlockingProfileBaseModel¶

Attribute	Type	Required	Default	Description
name	str	Yes	None	Profile name
description	str	No	None	Description of the profile
rules	List[FileBlockingRule]	No	None	List of file blocking rules
folder	str	No**	None	Folder location. Max 64 chars
snippet	str	No**	None	Snippet location. Max 64 chars
device	str	No**	None	Device location. Max 64 chars

** Exactly one container (folder/snippet/device) must be provided for create operations

FileBlockingProfileCreateModel¶

Inherits all fields from FileBlockingProfileBaseModel and enforces that exactly one of folder, snippet, or device is provided during creation.

FileBlockingProfileUpdateModel¶

Extends FileBlockingProfileBaseModel by adding:

Attribute	Type	Required	Default	Description
id	UUID	Yes	None	The unique identifier of the profile

FileBlockingProfileResponseModel¶

Extends FileBlockingProfileBaseModel by adding:

Attribute	Type	Required	Default	Description
id	UUID	Yes	None	The unique identifier of the profile

The response model uses extra="ignore" configuration instead of extra="forbid", allowing it to accept additional fields returned by the API without raising validation errors.

Enum Types¶

FileBlockingAction¶

Defines the available file blocking actions:

Value	Description
`alert`	Alert on file transfer but allow it
`block`	Block the file transfer
`continue`	Prompt user for confirmation before continuing

FileBlockingDirection¶

Defines the direction of file transfer to match:

Value	Description
`download`	Match file downloads only
`upload`	Match file uploads only
`both`	Match both directions

Component Models¶

FileBlockingRule¶

Represents a rule within a file blocking profile. Each rule defines the action to take based on application, direction, and file type.

Attribute	Type	Required	Default	Description
name	str	Yes	None	Name of the rule
action	FileBlockingAction	No	alert	Action to take when rule matches
application	List[str]	No	["any"]	Applications to match
direction	FileBlockingDirection	No	both	Direction of file transfer
file_type	List[str]	No	["any"]	File types to match

Exceptions¶

The File Blocking Profile models can raise the following exceptions during validation:

ValueError: Raised in several scenarios:
- When multiple container types (folder/snippet/device) are specified for create operations
- When no container type is specified for create operations
- When name pattern validation fails
- When container field pattern validation fails
- When field length limits are exceeded

Model Validators¶

Container Type Validation¶

For create operations, exactly one container type must be specified:

from scm.models.security import FileBlockingProfileCreateModel

# Error: multiple containers specified
try:
    profile = FileBlockingProfileCreateModel(
        name="invalid-profile",
        folder="Texas",
        device="fw01",  # Can't specify both folder and device
        rules=[{
            "name": "rule1",
            "action": "block",
            "application": ["any"],
            "direction": "both",
            "file_type": ["exe"]
        }]
    )
except ValueError as e:
    print(e)  # "Exactly one of 'folder', 'snippet', or 'device' must be provided."

# Error: no container specified
try:
    profile = FileBlockingProfileCreateModel(
        name="invalid-profile",
        rules=[{
            "name": "rule1",
            "action": "block",
            "application": ["any"],
            "direction": "both",
            "file_type": ["exe"]
        }]
    )
except ValueError as e:
    print(e)  # "Exactly one of 'folder', 'snippet', or 'device' must be provided."

Usage Examples¶

Creating a Basic Profile¶

from scm.client import Scm

# Initialize client
client = Scm(
    client_id="your_client_id",
    client_secret="your_client_secret",
    tsg_id="your_tsg_id"
)

# Using dictionary
profile_dict = {
    "name": "basic-file-blocking",
    "description": "Basic file blocking profile",
    "folder": "Texas",
    "rules": [{
        "name": "block-exe",
        "action": "block",
        "application": ["any"],
        "direction": "both",
        "file_type": ["exe", "dll"]
    }]
}

response = client.file_blocking_profile.create(profile_dict)
print(f"Created profile: {response.name}")

Creating a Profile with Multiple Rules¶

from scm.client import Scm

# Initialize client
client = Scm(
    client_id="your_client_id",
    client_secret="your_client_secret",
    tsg_id="your_tsg_id"
)

# Create the profile with multiple rules using dictionary
multi_rule_config = {
    "name": "comprehensive-file-blocking",
    "description": "Profile with multiple file blocking rules",
    "folder": "Texas",
    "rules": [
        {
            "name": "block-executables",
            "action": "block",
            "application": ["web-browsing", "ftp"],
            "direction": "download",
            "file_type": ["exe", "msi", "bat", "cmd"]
        },
        {
            "name": "alert-documents",
            "action": "alert",
            "application": ["any"],
            "direction": "upload",
            "file_type": ["doc", "docx", "pdf", "xls", "xlsx"]
        },
        {
            "name": "continue-archives",
            "action": "continue",
            "application": ["any"],
            "direction": "download",
            "file_type": ["zip", "tar", "gz", "rar"]
        }
    ]
}

response = client.file_blocking_profile.create(multi_rule_config)
print(f"Created profile with {len(response.rules)} rules")

Updating a Profile¶

from scm.client import Scm

# Initialize client
client = Scm(
    client_id="your_client_id",
    client_secret="your_client_secret",
    tsg_id="your_tsg_id"
)

# Fetch existing profile
existing = client.file_blocking_profile.fetch(name="basic-file-blocking", folder="Texas")

# Modify attributes using dot notation
existing.description = "Updated file blocking profile"

# Add a new rule
if existing.rules:
    existing.rules.append({
        "name": "alert-scripts",
        "action": "alert",
        "application": ["any"],
        "direction": "both",
        "file_type": ["js", "vbs", "ps1"]
    })

# Pass modified object to update()
updated = client.file_blocking_profile.update(existing)
print(f"Updated profile: {updated.name}")

Listing and Filtering Profiles¶

# List all file blocking profiles in a folder
all_profiles = client.file_blocking_profile.list(folder="Texas")
print(f"Found {len(all_profiles)} profiles")

# Process results
for profile in all_profiles:
    print(f"Profile: {profile.name}")
    if profile.rules:
        print(f"  Rules: {len(profile.rules)}")
        for rule in profile.rules:
            print(f"    - {rule.name}: {rule.action} ({rule.direction})")
            print(f"      File types: {rule.file_type}")