topic Re: Ability to report on user web searches in General Topics

Ability to report on user web searches

pmcglinchey — Tue, 21 Jan 2014 15:29:57 GMT

I work in a large K-12. We had used Blue Coat for our Web Security/Proxy before moving entirely to PAN. With Blue Coat we had the ability to produce reports on users search terms. Does anyone know if this is possible within PAN-OS?

Thank you,

Patrick

Re: Ability to report on user web searches

amcafee — Tue, 03 May 2016 21:44:32 GMT

Did you ever figure out a method for reporting user search queries through the Palo Alto firewall?

Re: Ability to report on user web searches

OtakarKlier — Tue, 03 May 2016 22:27:33 GMT

Hello,

I could be wrong, however it only logs what url's the person visited not what they typed into a search bar.

Regards,

Re: Ability to report on user web searches

Raido_Rattameister — Wed, 04 May 2016 09:45:17 GMT

Try to find something that stands out in search query.

For example if you search Palo Alto Networks in Chrome search term is:

https://www.google.co.uk/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=palo%20alto%20networks

So you could start with something like:

( url contains 'www.google' ) and ( url contains 'q=' ) and !( url contains 'doubleclick' )

Re: Ability to report on user web searches

OtakarKlier — Wed, 04 May 2016 13:33:12 GMT

Or perhaps something like safe search. While it may not report on what is typed, it may prevent the kids from seeing things they shouldnt...

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/url-filtering/enable-safe-search-enforcement#69316

Just another thought...

Re: Ability to report on user web searches

Raido_Rattameister — Wed, 04 May 2016 14:12:43 GMT

Also keep in mind that if you don't decrypt then URL log shows only www.google.com/ as this is visible on the certificate.

Actual search term goes inside encrypted payload.

Re: Ability to report on user web searches

amcafee — Wed, 04 May 2016 19:53:40 GMT

Thanks for the good info.

Build in reporting of search queries, especially suspicious keywords, would be a nice feature to add for K-12 customers who need to stay CIPA compliant.

We still like our PA-3020 though, for all the other great work it does for us.

Re: Ability to report on user web searches

dannon — Thu, 05 May 2016 17:09:13 GMT

Agreed.

We have been wanting this feature for 3 years now and have brought it up to Palo and logged it as a feature request. It must not be a priority for Palo.

The best product in this regard was Lightspeed Systems content filter. They have a very nice reporing system and logging layout. It would also log keyword searches by user and give daily reports and real-time data on them. Sadly, the rest of the product wasn't great, but reports and kwd searches/reports were spot-on.

I'd love to have this in Palo. I hate their reporting and have wanted an overhaul since the beginning. Being a K12 school district, we have different needs than corporate sector.

Re: Ability to report on user web searches

amcafee — Thu, 05 May 2016 17:40:01 GMT

+1 on Lightspeed Rocket being great at reporting details. We are needing to refresh our Rocket appliance hardware this year. $20k for a new appliance and 1 year of web filtering, and MDM. I'd gladly put that funding toward a redundant PA-3020 if PAN-OS were more configurable for K-12 environments.