In addition to being used by the load partial command, you can use xpath to show config of a firewall in the CLI.
The following is an example.
show config running xpath devices/entry[@name='localhost.localdomain']/deviceconfig/system
show config running xpath *//rulebase/security/rules