topic Re: What difference are between 'user eq' and 'user in' in filter of traffic logs? in General Topics

What difference are between 'user eq' and 'user in' in filter of traffic logs?

KiCheon.Lee — Tue, 26 Aug 2014 03:23:06 GMT

Hello,

What difference are between 'user eq' and 'user in' in filter of traffic logs?

I want to see output which is filtered by partial user-ID not full user-ID.

For example, There are as below user-IDs.

SA10001

SA10002

UQ20001

UQ20002

.......

I want to filter for all started 'SA' users in traffic logs.

KC Lee

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

HULK — Tue, 26 Aug 2014 04:36:59 GMT

Hello KC,

"eq" will try to match the exact keyword. Could you please try to use "in SA" in the filter (partial match keyword). Please find mentioned KB article for available options: Filtering Traffic Logs for Only Unidentified Users

Thanks

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

KiCheon.Lee — Tue, 26 Aug 2014 05:20:47 GMT

Hello HULK,

First, Thanks for your answer.

I already looked above liked document. and I also tried to use "in SA" in the filter.

But I could see nothing logs in traffic logs.

In addition, PANOS is 5.0.10.

Thanks

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

Retired Member — Tue, 26 Aug 2014 11:48:04 GMT

Hi cheon,

I also tried to do test and it's available but not working.

GOOD LUCK~

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

bat — Tue, 26 Aug 2014 20:53:19 GMT

Hi cheon

"User eq" looks for a exact match that you provide. "User in" however can be used to perform queries such as:

user.src in "cn=test,ou=sec_g,ou=pan,dc=paloaltonetworks,dc=local"

Thus "User in" looks if the user is part of the group.

In your case if all username starting with SA are part of a particular group you can provide a similar query.

Let me know how it works out.

Thanks

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

KiCheon.Lee — Thu, 28 Aug 2014 02:41:29 GMT

Thanks for your answer, csharma.

But we use xml method not AD with LDAP.

In case, How should I use filtering?

Thanks

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

bat — Thu, 28 Aug 2014 03:14:45 GMT

cheon

You can do the same thing if you are using XML API, just provide the group entry as follows:

<uid-message>

<type>update</type>

<login>

</entry>

</login>

<entry%20name="group1"> >>>>>>>>>>>>>>>>>>>>>plano2003/csharma is part of group1

</members>

</entry>

</groups>

</payload>

</uid-message>

Now if you check the CLI:

[edit]

admin@39-PA-3020# run show user ip-user-mapping all

IP Vsys From User IdleTimeout(s) MaxTimeout(s)

--------------- ------ ------- -------------------------------- -------------- -------------

192.168.39.209 vsys1 XMLAPI plano2003\csharma 1194 1194

Total: 1 user

admin@39-PA-3020# run show user group list

group1 >>>>>>>>>>>>>>>>>>>>>>>group we just added

Total: 1

Now the query will be modified as follows (user.src in 'group1') where group1 is the group of the users we added through XML API.

In your case you can modify your XML API to make all users starting with 'SA' as one group and users starting with as 'UQ' as part of another group.

Let me know if you have any queries.

Thanks

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

KiCheon.Lee — Fri, 05 Sep 2014 02:31:13 GMT

Hi csharma,

Thanks for your answer.

It help me very useful.

But my customer want to filter partial characters on many groups.

Do you know another way excepted same group?

We can not category group by partial characters.

Thanks