I started playing around with the Palo Alto API a while back, and found that you could more easily do certain things through the API, versus using the Palo Alto Panorama web interface.
Similar to the Active Directory tool that I build a while back, then plan is to add multiple tabs to the GUI, to allow us to perform different function. However, I might be moving away from working with this firewall, so the work may not be completed. That being said, with the script in its current state we can query for active VPN users, something that takes some digging through the GUI to find. We can also find previously connected users. The “New_API_Key” function can also be extracted and used in other script, as it provides an easy way to manage API keys.
You can find the script on my GitHub page here.