topic Re: Reports based on groups in General Topics

Reports based on groups

Retired Member — Tue, 09 Jul 2013 07:18:16 GMT

Hi,

When we try to get custom reports by typing a query for source user(domain\group) and run now, it gets empty.when we type user name it is working.

Any idea ?

Thanks

Re: Reports based on groups

UhMayYeah — Tue, 09 Jul 2013 09:15:49 GMT

Try following query :

(user.src in 'cn=home,cn=users,dc=amb,dc=local')

OR (user.src in 'amb\home')

Re: Reports based on groups

Retired Member — Tue, 09 Jul 2013 12:02:05 GMT

we already tried both but report comes empty.

Re: Reports based on groups

UhMayYeah — Tue, 09 Jul 2013 18:59:47 GMT

Can you query traffic logs using query in above formats?

Re: Reports based on groups

Retired Member — Tue, 09 Jul 2013 20:39:19 GMT

for users yes we can query with domain\user

Re: Reports based on groups

dpalani — Tue, 09 Jul 2013 22:10:38 GMT

Hi,

The log format in 3.x is

domain, receive_time, serial, type, subtype, config_ver, time_generated, src, dst, natsrc, natdst, rule, srcuser, dstuser, app, vsys, from, to, inbound_if, outbound_if, logset, time_received,

sessionid, repeatcnt, sport, dport, natsport, natdport, flags, proto, action, bytes, bytes_sent, bytes_received, packets, start, elapsed, category, padding

If the record of the group is not written to the traffic log, i suppose it is an expected behavior that the queries based on groups will return empty.

I may be wrong since its 3.x panos.

Regards,

Deepak

Re: Reports based on groups

UhMayYeah — Tue, 09 Jul 2013 23:28:58 GMT

Try this :

> show user ip-user-mapping ip <ip of the user which shows up in traffic Logs>

Use the Group in the Group(s) field for the query in the traffic logs : (user.src in 'Group in the Group(s) field')

Re: Reports based on groups

Retired Member — Wed, 10 Jul 2013 00:03:03 GMT

Thanks.We did that.

Still reports come empty for gorups.

Re: Reports based on groups

apasupulati — Wed, 10 Jul 2013 03:23:50 GMT

Hello,

Is PAN firewall retrieving the user-group information properly?

>show user group name <group name> //this should list all the group members of the group

>show user user-IDs match user <username> //shows the groups a user is a part of.

If the firewall is able to identify the users in the group and see traffic logs for these users, it should match the query for the report.

Thanks,

Aditi