topic User activity reports on Panorama in General Topics

User activity reports on Panorama

thierry_demeire — Thu, 23 Sep 2010 09:47:23 GMT

We've just got a new Panorama and Palo Alto implementation done.

Reviewing the reporting options I noticed that a "User Activity Report" can not be requested from the Panorama server.

It can be requested from the devices themselves.

My issue with running the report from the devices is that we have an active/Passive setup, so I need to run the report on both devices and bring them togehter. Knowing the report is in PDF-format, this is a hell of a job.

Seeing that Panorama is THE reporting engine, I was wondering if something needs to be tuned or enabled on Panorama to be able to run the user activity report from the Panorama server, which could them combine logs from both devices.

Any insights are more than welcome.

Cheers

Re: User activity reports on Panorama

James — Thu, 23 Sep 2010 10:22:01 GMT

Hi There,

You can filter reports on Panorama by user to achieve something similar to the UAR - this is the current solution. Other than changing the context in Panorama and running the report directly from the device.

The "Canned" UAR reporting function will be added to the next major release of Panorama due out begining of 2011.

Best Regards

James

Re: User activity reports on Panorama

ariodique — Tue, 30 Nov 2010 23:53:21 GMT

Regarding UAR, is there a way to run this report based on User IP? Will this be added to Panorama early 2011? Not every report on my end can be ran based on a username because not every machine is on ldap or ad. Esp. the Mac and Linux boxes..

Re: User activity reports on Panorama

James — Wed, 01 Dec 2010 07:03:21 GMT

Hi There,

The answer to both your questions is yes. You can try the IP report today and the Panorama UAR functionality is currently in beta.

Thanks

James

Re: User activity reports on Panorama

CWillms — Fri, 03 Dec 2010 14:29:13 GMT

OK - so how do you pull a user report based on IP, we have a similar situation to ariodique's. I keep getting "no data found" - clearly I'm doing something wrong. I need a report that goes back several months but I can't seem to determine how far back my data goes before it "rolls off". We also use Panorama for managing and reporting.