topic Re: configuration report in General Topics

configuration report

jdprovine — Tue, 05 Dec 2017 19:46:35 GMT

has anyone tried to set up a custome report that shows/alert or lets you know when someone has made a change to the configuration? Or if you have your own home grown method that you use to audit configuration changes.

Re: configuration report

OtakarKlier — Tue, 05 Dec 2017 22:33:37 GMT

Hello,

While I'm not sure of any reports, however you can setup email alerts when changes are made, this can become rather chatty. We perform monthly audits and I use the config audit tool. just select the days and let it run then export to excel and add my notes.

Hope that helps.

Regards,

Re: configuration report

DarinSutton — Wed, 06 Dec 2017 08:11:34 GMT

the 'Canned reports' are on Traffic...Threat...URL....NOT Configuration or system

also it is not a choice in the custom reports (Database)

however - you could view the configuration logs and build(save) a filter that would

look for Config changes...ie Set, Edit, Commit -- single or combination of search parameters

after saving it you can re-run it periodically and even export to .csv

Re: configuration report

jdprovine — Wed, 06 Dec 2017 14:15:04 GMT

@OtakarKlier

what OS are you using? I am using 7.1.13 and I do not see the configuration option that you are showing here

Re: configuration report

OtakarKlier — Wed, 06 Dec 2017 14:18:31 GMT

We are on the 8 track already. I know its an option in 7 as well, I think you just have to email alert all high and critical events? But I could be wrong on that one.

Re: configuration report

DarinSutton — Wed, 06 Dec 2017 17:29:54 GMT

@OtakarKlier - the log forward setting you mentioned are present and correct ....

but they are for traffic ...threat....tunnel...etc

still doesnt show configuration

Re: configuration report

BPry — Wed, 06 Dec 2017 20:18:53 GMT

@jdprovine

It's actually going to be an option within the Log Settings for Confiugration.

Re: configuration report

jdprovine — Wed, 06 Dec 2017 19:36:11 GMT

@BPry

I went to device\log setting\system and don't see the screen you are showing

Re: configuration report

BPry — Wed, 06 Dec 2017 20:16:31 GMT

@jdprovine,

Can you send a screenshot of what you are seeing.

Re: configuration report

jdprovine — Wed, 06 Dec 2017 20:47:20 GMT

@BPry

I hope this is enought to tell

Re: configuration report

BPry — Wed, 06 Dec 2017 21:04:56 GMT

@jdprovine,

Okay, I thought 7.1.x had the configuration option...guess not. You can still setup a Email alert for High and Critical events for System alerts. A config edit will register as the following

Type: general

Severity: high

Event: general

Description: Commit job succeeded for user bpry.

Since you are running 7.1.x you won't have the option to specify a filter, so you'll need to at least generate an email for any System level event with a 'high' severity rating. I would recommend getting emails on Critical severity events while you are at it.

Re: configuration report

khuynh — Wed, 06 Dec 2017 21:41:10 GMT

Hello jprovine,

Are you using a super admin account to log in to the GUI ? Maybe you're using a account with an admin role which doesnt display the configuration part of the menu...

You should be able to use it, even in 7.1: https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface-help/device/device-log-settings

Re: configuration report

BPry — Wed, 06 Dec 2017 22:20:00 GMT

@khuynh, I was pretty sure you could. Like I said I don't have any boxes to test it with anymore though.

@jdprovine,

The System one would work fine, but I did just look back at my old config files and there is indefinitely a section of the configuration that would corispond with the configuration part being present in 7.1.x

Re: configuration report

jdprovine — Thu, 07 Dec 2017 13:25:22 GMT

@khuynh

I am a superuser and my OS is 7.1.13