topic Re: Config Audit PDF Report in General Topics

Config Audit PDF Report

MHamad — Tue, 17 Jan 2017 16:11:32 GMT

Hi all lovely people of Palo Alto Live,

I want to see if there is a way to generate a custom (or in-built) report for the config changes on the Palo Alto?

For example, the requirement is that a weekly report is needed on what changes are made by which administrators in the past week, or the difference in config between today and the config 7 days ago.

As of now, I don't see any option from the GUI of Palo Alto.

Your help is greatly appreciated,

Thanks a Bunch!

Re: Config Audit PDF Report

kiwi — Tue, 17 Jan 2017 17:33:13 GMT

Hi @MHamad,

With the 'Config Audit' option you can easily compare any configuration version.

You find the option under Device > Config Audit

Config Audit

Also, the configuration logfile will provide you more information on specific changes made by specific administrators :

Configuration Log

Cheers,

-Kim.

Re: Config Audit PDF Report

MHamad — Tue, 17 Jan 2017 17:39:06 GMT

Hi Kiwi,

Yes that option is well known. Just looking for a way to get a report preferably PDF and have it scheduled weekly.

Thanks,

Re: Config Audit PDF Report

kiwi — Wed, 18 Jan 2017 14:49:23 GMT

Hi @MHamad,

Currently there is no such feature. There is already a feature request for it (ID 986).

Please reach out to your local SE and ask him to add your vote.

In the meantime you could use the mentioned method from the previous comments.

Alternatively you could try getting the info using API calls.

For example the following API call will return a job ID (note that you will have to edit the query or script it to match your timeframe) :

https://xxxxxxxxx/api/?type=log&log-type=config&key=xxxxxxxxxxxxxxxxxxxx&query=(%20receive_time%20geq%20%272016/12/18%2016:11:04%27%20)

>> query job enqueued with jobid 945

Use the job-ID that you got from the previous call to get the info in a 2nd API call :

https://xxxxxxxxx/api/?type=log&action=get&job-id=945&key=xxxxxxxxxxxxxxxxxxxx

>> this should return an XML output of your query.

Another possibility would be to forward all your config log to a syslog server or just mail it to you and parse it outside the firewall.

Cheers !

-Kim.

Re: Config Audit PDF Report

OtakarKlier — Wed, 18 Jan 2017 22:56:09 GMT

Hello,

I also would like this feature, however in the meantime I am jsut using the logs. Go to Montior->Logs->Configuration. Then filter it to your time frame and export as a csv, then save as a pdf. Its a few extra steps, but shows what was done and by which admin.

Hope this helps.

Re: Config Audit PDF Report

Sly_Cooper — Tue, 02 Jun 2020 18:40:38 GMT

@kiwiThanks for the API guidance. I tried the queries and it provides the xml output. The issue for me however is that the xml log contains only 20 entries (like the page view). Is there any way to receive "all entries"?