topic Re: Any 3rd party app for user activity report? in General Topics

Any 3rd party app for user activity report?

SThatipelly — Thu, 28 Mar 2019 16:02:40 GMT

Anyone using a 3rd party app to generate user activity reports from Palo logs? The report I get from Palo is not that interactive and informative.

Re: Any 3rd party app for user activity report?

BPry — Thu, 28 Mar 2019 21:07:36 GMT

@SThatipelly,

What type of report exactly are you looking for. If you offload the logs to a log collector of some type there are plenty of different applications/add-ons/custom things you can do with the information. We kind of need to know what you are looking for to recommend anything though.

Re: Any 3rd party app for user activity report?

SThatipelly — Fri, 29 Mar 2019 13:59:33 GMT

I am looking for a tool that can give me detailed user activity report of a user. It should help me in doing forensics.

Re: Any 3rd party app for user activity report?

BPry — Fri, 29 Mar 2019 18:16:56 GMT

@SThatipelly,

Again, details are key here and we need them to recommend a product. This means that we need to actually know what you are looking for in the report that you are wishing to generate. Do you want to be able to tell how much time someone spends in a website category? Do you want to keep track of how much time someone spends at a base URL? Is the current built-in user activity report good enough in a detail perspective, but it doesn't look nice enough to present to leadership? Maybe you are looking for something more like a SOC solution?

Re: Any 3rd party app for user activity report?

SThatipelly — Mon, 01 Apr 2019 12:49:32 GMT

@BPry what you had mentioned in your response is exactly what i am looking but not like a SOC solution. I will be using it just for reporting purposes. Please suggest me a tool.

Re: Any 3rd party app for user activity report?

OtakarKlier — Mon, 01 Apr 2019 18:00:00 GMT

Hello,

Any SIEM tool should be able to provide the basics.

Hope that helps.

Re: Any 3rd party app for user activity report?

BPry — Tue, 02 Apr 2019 02:53:31 GMT

@SThatipelly ,

As @OtakarKlier mentioned this is table stakes for any SIEM and something that can be built out in pretty much anything. As you haven't said exactly what you are looking for, the easiest solution right out of the box would be Splunk with the Palo Alto plugin. That will give you a basic dashboard and you can built the more detailed reports as you see fit.

Re: Any 3rd party app for user activity report?

SThatipelly — Fri, 05 Apr 2019 12:42:04 GMT

we currently have Qradar that is doing basic Palo alto traffic reporting. but my upper management wants to have a reporting tool that can give detailed info about a user activity report(not much interested in whole traffic stats).