topic Re: Using User-ID XML API to get data? in Automation/API Discussions

Using User-ID XML API to get data?

aigarkais — Fri, 04 Mar 2011 12:13:02 GMT

Is there a way to use User-ID xml api to get data from User-ID agent?

Re: Using User-ID XML API to get data?

mwalter — Mon, 14 Mar 2011 21:40:19 GMT

Unfortunately there isn't. The User-ID XML API is designed to feed User-IP information into the Agent and the firewall, but not to retrieve any data. Out of curiousity, may I still ask what you are trying to achieve?

Re: Using User-ID XML API to get data?

yesitisme_007 — Mon, 02 Apr 2012 16:41:02 GMT

I don't know about aigarkais but I would like to be able to get data from the agent so I can do user-id to IP lookups without having to log into a PAN device.

A tool like that would be useful to a number of IT groups for supporting users. Currently, if support needs to do a remote login to a workstation, they need to ask the user what their IP address is. If the user is not very knowledgable about computers, this can be a frustrating task for both the user and the support person. Leveraging the user-id agent to lookup the mapping would make a lot of people happy.

Re: Using User-ID XML API to get data?

jseals — Mon, 02 Apr 2012 17:52:39 GMT

Hi Jim,

You can poll the firewall for its current list of mappings.

I was able to run:

$ curl -k "https://x.x.x.x/api/?type=op&cmd=<show><user><ip-user-mapping><all></all></ip-user-mapping></user></show>&key=INSERT_API_KEY_HERE"

from any machine with curl and it outputs all of the mappings on the firewall. It's not polling the agent, but it's close and will probably suffice for what you're wanting. Note, you'll have to have XML API setup, and you'll need to insert your own firewall's IP and XML API key in the above command.

Thanks,

Jason Seals

Re: Using User-ID XML API to get data?

jseals — Mon, 02 Apr 2012 18:00:27 GMT

Jim,

Here is the wget equivalent if you'd prefer:

wget --no-check-certificate "https://x.x.x.x/api/?type=op&cmd=<show><user><ip-user-mapping><all></all></ip-user-mapping></user></show>&key=INSERT_API_KEY_HERE"

After the wget finishes, you'll just need to view the contents of the index file it pulls down as that contains the user info it pulled from the firewall.

Thanks,

Jason Seals

Re: Using User-ID XML API to get data?

sps186 — Mon, 09 Apr 2012 20:01:56 GMT

Hello,

I'm curious as to how to set this information. Using the https://<mgmt ip>/api API browser, I don't see where or how I may set this information. Using IMAP/POP3 logs, I have a plethora of IP<->username mappings - just need to know how to get them into our 2050.

Thanks in advance. 😃

Re: Using User-ID XML API to get data?

sps186 — Mon, 09 Apr 2012 20:17:30 GMT

Disregard -- I've found ye olde DOC-1348.

Re: Using User-ID XML API to get data?

ericgearhart — Thu, 05 Sep 2013 20:01:56 GMT

We send syslog data from our PA devices that include the username field populated and the IP address they're coming from, and we heavily use our SIEM to normalize that data to provide username-IP mappings all the time.

You could build a home grown web interface search that could search a syslog server's logs and return username-IP mappings. Or use something like ELSA and get web access to your PA logs that way:

enterprise-log-search-and-archive - Enterprise log search and archive (ELSA) is an industrial-strength solution for ce…