topic Chromebook usernames in Palo Alto logs. in General Topics

Chromebook usernames in Palo Alto logs.

dholmes — Wed, 25 Oct 2023 16:15:41 GMT

Hi,

I was wanting to know if it is now possible to have the Palo Alto firewall log url traffic with the username from chromebooks. It shows the username for all windows users as it syncs with AD, but can't get the chromebook users to show up. I set Google to work with Cloud identity engine, thinking that might be a solution. So far can't get them to show up in the logs by username. IP address only. Is this even possible? If you are going to sell URL Filtering, seems you should be able to log users activity by username.

Re: Chromebook usernames in Palo Alto logs.

BPry — Wed, 25 Oct 2023 17:46:13 GMT

@dholmes,

When you setup CIE you still need to generate authentication events to map users properly. One way to get those events would be through an authentication policy.

Re: Chromebook usernames in Palo Alto logs.

TomYoung — Wed, 25 Oct 2023 20:05:04 GMT

Hi @dholmes ,

User-ID and Chromebooks is a very common request. Check out this URL -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSNCA0#Chromebooks-and-User-ID. You could use a Chrome plugin as described. You could also use GlobalProtect with Internal Host Detection. Or, you could use the Authentication Portal as @BPry mentioned.

Thanks,

Tom

Re: Chromebook usernames in Palo Alto logs.

dholmes — Thu, 26 Oct 2023 15:30:22 GMT

I looked at @BPry post. I would need a little direction on how to set that up for CIE and Google.