topic Re: Email Alert on PAN/PAFW for new admin account Creation in Panorama Discussions

Email Alert on PAN/PAFW for new admin account Creation

Adam_DiMarco — Tue, 26 Sep 2023 17:45:36 GMT

Hi,

I am looking to create email alerts for when ANY user creates a new admin account of anytype on both our Panorama and any of our firewalls managed by panorama. Our PAFW send/forward their logs to our M600 Panorama device.

Any have any link or suggestions? Purpose being to know if any admin create local or alternate admin accounts, or scenario if an admin account was compromised and that intruder went to create an alternate account.

Thanks,

Adam D

Re: Email Alert on PAN/PAFW for new admin account Creation

TomYoung — Tue, 26 Sep 2023 18:24:35 GMT

Hi @Adam_DiMarco ,

Follow steps 1 and 2 here. You will need an SMTP Relay IP address. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/configure-email-alerts
For step 3, configure the settings below under Device > Log Settings > Configuration. If you open Filter Builder, you can test the filter with View Filtered Logs. You can also test the filter under Monitor > Logs > Configuration.

If you are forwarding all of your configuration logs to Panorama, you only have to do it once on Panorama. It also catches administrators configured in a template.

Thanks,

Tom

Re: Email Alert on PAN/PAFW for new admin account Creation

Adam_DiMarco — Tue, 26 Sep 2023 18:33:49 GMT

Thanks Tom, just configured that and tested it out and got an email notification.