[lucia-sb]

What does this PR do?

Removes the check's threat log collection: the pan_firewall.threat.count metric and the collect_threats option. With it go the only use of the XML API type=log endpoint and the streamed log reader, so the Agent's admin role no longer needs the XML API Log permission.

Motivation

Threat logs reach Datadog through the integration's existing syslog log collection (source:pan.firewall), and the OOTB dashboard's "Threats by Severity" and "Top threats" widgets already count them from logs. No dashboard widget or monitor uses threat.count. The log query was the most expensive call in the poll and the most complex collector (async jobs, seqno watermarks, reset detection), and it isn't proxied through Panorama.

This was introduced in #25662 and released in 3.4.0, which no Agent release ships yet. Related: #25751 (README) still documents threat counts and the Log permission and will need a matching update; #25806 touches nearby tests and will need a rebase.

References: Product brief, Engineering page

Checklist before requesting review

• I self-reviewed the full diff, and this description matches the final change
• Tests cover the change, or this description explains why none are needed
• Automated review comments, including Codex review, were addressed or answered
• I, the human author, understand this change, can explain it to reviewers, and believe it meets the repository standards

🤖 Generated with Claude Code

[dd-octo-sts]

✅ Dispatcher tests: passed

Dispatcher beta: informational only
Existing CI remains the merge signal.

  2/2 jobs

✅ 2 passed · nothing failed

Batches · ✅ batch-01 2/2

_{Dispatcher finished on acb6e1d — GitHub Run · Dispatcher Logs.}

[cit-pr-commenter-54b7da]

evalya-impact-summary

Evalya CI impact

Impact analysis: 0 selected, 0 skipped (of 0 test tasks)
Publish tasks:   4 (always emitted)
Changed files:   36

Full impact report
Learn more about CI impact filtering

[datadog-official]

   

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

Validate repository | Run Validations / Validate

View more details · View in GitHub Actions

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 96.83% (+7.10%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 132bf1b | Docs | View more details | Give us feedback!}

[dd-octo-sts]

Disk usage change

Commit 92981ac compared against c5d1e30.

Uncompressed

linux-aarch64	linux-x86_64	macos-aarch64	macos-x86_64	windows-x86_64
🟢 -14.21 KiB	🟢 -14.21 KiB	🟢 -14.21 KiB	🟢 -14.21 KiB	🟢 -14.21 KiB

Details

Name	Version	Type	linux-aarch64	linux-x86_64	macos-aarch64	macos-x86_64	windows-x86_64
pan_firewall	3.4.0	Integration	🟢 -14.21 KiB	🟢 -14.21 KiB	🟢 -14.21 KiB	🟢 -14.21 KiB	🟢 -14.21 KiB

Compressed

linux-aarch64	linux-x86_64	macos-aarch64	macos-x86_64	windows-x86_64
🟢 -4.61 KiB	🟢 -4.61 KiB	🟢 -4.61 KiB	🟢 -4.61 KiB	🟢 -4.61 KiB

Details

Name	Version	Type	linux-aarch64	linux-x86_64	macos-aarch64	macos-x86_64	windows-x86_64
pan_firewall	3.4.0	Integration	🟢 -4.61 KiB	🟢 -4.61 KiB	🟢 -4.61 KiB	🟢 -4.61 KiB	🟢 -4.61 KiB

[dd-octo-sts]

Validation Report

Validation	Description	Status
pr-description	Validate the pull request checklist and visible description length To fix: Tick every item in .github/PULL_REQUEST_TEMPLATE.md and keep the description under 3,000 visible characters.	❌

Run ddev validate all changed --fix to attempt to auto-fix supported validations.

Passed validations (21)

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata, naming, and wheel contents	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run