topic Re: Is there a way to force Applications Seen to Update? in General Topics

Is there a way to force Applications Seen to Update?

khaldeman — Thu, 26 Sep 2019 15:47:17 GMT

I'm running PanOS 9.0.3-h3 and I'm creating some new Security Policies.

I like that I can see what applications are getting hit in the rule.

My only problem is that while I'm testing, I seem to have to wait overnight for the Applications Seen to get updated for new rules.

Is there a way from the GUI or CLI to force the processing of the Apps seen?

What's the update schedule look like?

Thanks,

Kevin

Re: Is there a way to force Applications Seen to Update?

MP18 — Sat, 28 Sep 2019 04:46:37 GMT

I am also curious to know answer for this

Re: Is there a way to force Applications Seen to Update?

reaper — Sat, 28 Sep 2019 08:05:07 GMT

The report that sifts through the logs to determine which applications are used in which rule runs overnight with all the other reports

Re: Is there a way to force Applications Seen to Update?

MP18 — Sun, 29 Sep 2019 16:02:14 GMT

Thanks for the reply Reaper!

Re: Is there a way to force Applications Seen to Update?

khaldeman — Mon, 30 Sep 2019 13:06:47 GMT

I understand why this would be done in a scheduled task. It would be nice if there was a way to fire it off on the CLI.

Thanks for the answer.

Re: Is there a way to force Applications Seen to Update?

reaper — Mon, 30 Sep 2019 13:16:26 GMT

i can see why firing it off 'on demand' would be nice, but this could also give you a false perspective as you might be tempted to run the report a bunch of times and end up only seeing a few applications that happen to have been seen in your timeframe, but there could be others that you'd miss (the intended timeframe is 30 days and over)