topic Re: PAN AD Useragent - Excluding users? in General Topics

PAN AD Useragent - Excluding users?

dagibbs — Sun, 14 Nov 2010 22:51:21 GMT

Hi.

Is it possible to exclude a specific user from the PAN agent configuration?

I know you can filter based on group - unfortunately, the user concerned, which is used for several automated processes, is also a member of AD groups which I can't exclude, so it gets reported every time it runs a background process - which is skewing reporting, as this task used reports a lot of traffic when it's not actually the user logged on the PC.

Can you tell the agent to specifically NOT report a user mapping for this user somehow?

Thanks

Re: PAN AD Useragent - Excluding users?

will2097 — Mon, 15 Nov 2010 07:41:05 GMT

Hi,

that's a nice easy one.

You can tell the User-ID Agent to ignore that particular user account. To do this, create a file called “ignore_user_list.txt” in the directory in
which the User-ID Agent was installed (typically c:\Program Files\Palo Alto Networks\PanAgent). Put in that file the name of the service account that you want the User-ID Agent to ignore.

I hope that helps,

All the best,

Will

Re: PAN AD Useragent - Excluding users?

dagibbs — Mon, 15 Nov 2010 21:56:28 GMT

Will.

thanks. I knew there was a way to do it, but I couldn't remember HOW - checked every option in the User agent GUI, but forgot about the text control files.

Working a treat now - appreciate your help.

Cheers.

Re: PAN AD Useragent - Excluding users?

mhuels — Thu, 09 Dec 2010 11:18:53 GMT

In which form does the agent estimate the items of the listfile?

Do i have to put the Active Directory Domain in front of the user?

Example:

if "win" is the name of the Active Directory Domain and "user" is the username

win\user

win/user

user

I guess, multiple user has to inserted in different lines?

After which time, the excluding list will fire?

Re: PAN AD Useragent - Excluding users?

odaos — Thu, 09 Dec 2010 16:58:41 GMT

Hello,

You will have to put the Active Directory Domain in front of the user. (domain/user)

Re: PAN AD Useragent - Excluding users?

dagibbs — Thu, 09 Dec 2010 20:27:26 GMT

mhuels wrote:

In which form does the agent estimate the items of the listfile?

Do i have to put the Active Directory Domain in front of the user?

Example:

if "win" is the name of the Active Directory Domain and "user" is the username

win\user

win/user

user

I guess, multiple user has to inserted in different lines?

After which time, the excluding list will fire?

Just

user

one username per line. The name of the file is "ignore_user.txt", and it needs to be put into the same directory as the "PanAgentService" executable.

Once you create this file, you must stop/start (or restart) the PanAgent service for it to take effect.

Cheers

Re: PAN AD Useragent - Excluding users?

mhuels — Fri, 10 Dec 2010 11:08:22 GMT

neither win/user in ignore_user_list.txt nor user in ignore_user.txt works.

Nothing to see about "ignore group or user" in the logfiles. I have the impression, the agent ignores the lists

ignore_user_list.txt

ignore_group_list.txt

allow_groups.txt

totally.

I will try to elevate the debug-level.

Re: PAN AD Useragent - Excluding users?

James — Fri, 10 Dec 2010 11:17:24 GMT

Hi There

The file is definitely ignore_user_list.txt

It is definitely just "user", no domain required

If it is not working, please make sure the file is in the User-ID Directory - normally in program files. Also, make sure the service has been restarted.

Thanks

James

Re: PAN AD Useragent - Excluding users?

mhuels — Fri, 10 Dec 2010 13:02:29 GMT

After i put "user" in "ignore_user_list.txt", the agent gui did not show "user" anymore. But in the PA-logviewer some "user" still remains. If testing the shown source-ip in the agent gui with "Get IP Information", the gui says "_unknown_". It seems to be, the PA does not accept "_unknown_" and presents instead of this the last known username.

I hope, till next monday is time enough for the firewall to time out the old rememberings. Perhaps i have to reboot the PA firewall?

Re: PAN AD Useragent - Excluding users?

James — Fri, 10 Dec 2010 13:33:22 GMT

Sounds like the user is in the cache.

Try this command to clear the offending IP:

jsherlow@PA-4050> clear user-cache ip
<ip/netmask> <x.x.x.x/y>

Thanks

James

Re: PAN AD Useragent - Excluding users?

mhuels — Fri, 10 Dec 2010 14:49:42 GMT

Mmh.

mhuels@mi2-pan2(active)> show clock

Fri Dec 10 15:43:25 CET 2010

mhuels@mi2-pan2(active)> show user ip-user-mapping ip 10.24.4.25

IP address: 10.24.4.25
User:        unknown
Ident. By:   UNKNOWN
Idle Timeout: 2527s
Max. TTL:    5527s
Groups that user belong to (used in policy)

The Logviewer shows nevertheless an user. Please look at the attachement.

Re: PAN AD Useragent - Excluding users?

James — Fri, 10 Dec 2010 15:23:25 GMT

Hmmm, indeed I agree that is somewhat strange.

At this point, we'l probably need to jump on your box. Please can you log a support case?

Thanks

James

Re: PAN AD Useragent - Excluding users?

dagibbs — Sun, 12 Dec 2010 21:40:28 GMT

jsherlow wrote:

Hi There

The file is definitely ignore_user_list.txt

It is definitely just "user", no domain required

If it is not working, please make sure the file is in the User-ID Directory - normally in program files. Also, make sure the service has been restarted.

Thanks

James

Sorry, my bad - the stupid Win2008 server I have the agent installed on is configured with the equally stupid windows default of hiding extensions, and my brain parsed the _list bit as the extension.

Yes, I have ignore_users_list.txt, and it works fine for me.

Apologies for the misleading post.

Re: PAN AD Useragent - Excluding users?

James — Sun, 12 Dec 2010 21:51:18 GMT

All's well that ends well

Re: PAN AD Useragent - Excluding users?

kazjak — Mon, 14 Mar 2011 11:57:40 GMT

Any plans to add Active Directory support for the ignore user list? We have more than a thousand computers working in a kiosk mode that have the "logged in acct" being ignored. We'd love to be able to pass off that admin piece to our NA's but the agent won't parse out users in an ignore group.. We are running 3 Agents and are getting tired of adding a user and restarting services each time an acct is created.

Thanks!

Re: PAN AD Useragent - Excluding users?

gswcowboy — Tue, 15 Mar 2011 13:18:28 GMT

Hi,

Just to clarify, but are you asking if there's a way to 'auto' populate the ignore user list via AD?

Re: PAN AD Useragent - Excluding users?

kazjak — Tue, 15 Mar 2011 15:03:18 GMT

We'd like to have an AD group called something like Pan-user-ignore group. All the user accts that we don't want the angent to monitor would go in this group. Then our Admins could add the user to the group as part of the account creation process. Currently the Admin has to give me the username, I have to append the ignore_user_list.txt and restart the services on all my agents to force the changes.

in a nut shell, we have a kiosk machine that is always logged in. Any user with internet access can launch an app, enter their credentials and browse the web as themselves. When the app closes it sends another security event changing the agents user to a "nobody" account. We have to ignore the kiosk acct otherwise during the users browsing experience the pc will send security events on behalf of the kiosk acct which switches the agent back to the kiok acct (which has limited browsing access).

Re: PAN AD Useragent - Excluding users?

reaper — Tue, 15 Mar 2011 16:31:46 GMT

Hi Kazjak

you should be able to add these users to that group and then add that group to the "ignore group" in panagent

regards

Tom

Re: PAN AD Useragent - Excluding users?

dagibbs — Tue, 15 Mar 2011 22:18:40 GMT

kazjak wrote:

Create your AD group, add your users to it, and add the group to the file "ignore_group_list.txt' in the PAN agent directory.

Restart your agent, and then you can simply add additional users to the AD group and never have to tweak the agent again.

Mine are in the format "domain\group" and they work fine.

Cheers.

Re: PAN AD Useragent - Excluding users?

kazjak — Wed, 16 Mar 2011 14:12:54 GMT

I figured out where I went wrong... I realized that when I checked the "Group Information" on my new group it wasn't parsing the user. Even though the user was not going to be added to any of the filter groups I still needed to add the new group as a filter group member before it would recognize the new AD group.