topic Re: Highest Risk User in Automation/API Discussions https://live.paloaltonetworks.com/t5/automation-api-discussions/highest-risk-user/m-p/14305#M366 <HTML><HEAD></HEAD><BODY><P>Hello James,</P><P></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">The best way to see how any report is generated is to look at the "Load Template" button on the custom reports dialog under Monitor &gt; Manage Custom Reports &gt; Add.&nbsp; If you scroll through the list, you can find risky users at the bottom.&nbsp; In this case, we determine risky user by their usage of high-risk applications. Notice the query of "risk-of-app eq 4 OR risk-of-app eq 5".</SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;"><BR /></SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;"><IMG alt="Custom_report_load_template.png" class="jive-image" src="https://live.paloaltonetworks.com/legacyfs/online/8053_Custom_report_load_template.png" style="width: 620px; height: 182px;" /></SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;"><BR /></SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">Hope that helps!</SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;"><BR /></SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">Regards,</SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">Kunal Adak<BR /></SPAN></P></BODY></HTML> Wed, 04 Sep 2013 15:07:33 GMT kadak 2013-09-04T15:07:33Z Highest Risk User https://live.paloaltonetworks.com/t5/automation-api-discussions/highest-risk-user/m-p/14304#M365 <HTML><HEAD></HEAD><BODY><P>The highest risk user on the predefined report doesn't have additional information under the URL Categories/Applications/Threats?</P><P></P><P>What are the details of an IP address becoming the "Highest Risk User"?</P></BODY></HTML> Thu, 29 Aug 2013 15:49:35 GMT https://live.paloaltonetworks.com/t5/automation-api-discussions/highest-risk-user/m-p/14304#M365 james_overton 2013-08-29T15:49:35Z Re: Highest Risk User https://live.paloaltonetworks.com/t5/automation-api-discussions/highest-risk-user/m-p/14305#M366 <HTML><HEAD></HEAD><BODY><P>Hello James,</P><P></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">The best way to see how any report is generated is to look at the "Load Template" button on the custom reports dialog under Monitor &gt; Manage Custom Reports &gt; Add.&nbsp; If you scroll through the list, you can find risky users at the bottom.&nbsp; In this case, we determine risky user by their usage of high-risk applications. Notice the query of "risk-of-app eq 4 OR risk-of-app eq 5".</SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;"><BR /></SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;"><IMG alt="Custom_report_load_template.png" class="jive-image" src="https://live.paloaltonetworks.com/legacyfs/online/8053_Custom_report_load_template.png" style="width: 620px; height: 182px;" /></SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;"><BR /></SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">Hope that helps!</SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;"><BR /></SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">Regards,</SPAN></P><P><SPAN style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">Kunal Adak<BR /></SPAN></P></BODY></HTML> Wed, 04 Sep 2013 15:07:33 GMT https://live.paloaltonetworks.com/t5/automation-api-discussions/highest-risk-user/m-p/14305#M366 kadak 2013-09-04T15:07:33Z