topic Is there a way to report or trigger email notification for correlated events? in General Topics

Is there a way to report or trigger email notification for correlated events?

jsalmans — Wed, 12 Jul 2017 16:31:50 GMT

I'm working towards generating some reports for our other IT departments and I noticed the correlated events have some really nice information that might indicate when someone is infected with Malware. I'd like to get that information over to our desktop support team but I'm not sure the best way to do it.

I could certainly give them restricted read-only accounts to Panorama to access relevant monitoring data but I see there are also a lot of reporting options. I do not, however, see any reporting or notification triggers for when correlated events are detected.

Is there something I'm missing or has this just not been implemented yet?

Thanks!

Re: Is there a way to report or trigger email notification for correlated events?

Anon1 — Thu, 13 Jul 2017 15:18:41 GMT

Do you already run PAN-OS 8? There are many improvements especially in the area of log forwarding.

Re: Is there a way to report or trigger email notification for correlated events?

jsalmans — Wed, 19 Jul 2017 14:54:09 GMT

@Anon1

I am actually running 8.0 on Panorama so I should have access to this. I'm hoping for something fairly easy to read for the end users who will likely be desktop technicians in this case. I guess even a CSV would be something in this case.

I've also just run across a use case for needing a config change report. I'd like to schedule a weekly report that lists information about config changes... maybe not so much the entire config change but user-selectable columns like we already have on other reports so that we can do something like just select the date/time, administrator username, and the commit description.

Anyone know if that is possible?

*edit* I see there is a config option on the Log Collector Forwarder so I'm trying that out along with the Correlated Events forwarder. I'm still definitely intersested to see if we could do Custom Reports and email schedules for these types of things or if it is on the radar as a requested feature.

Thanks!