topic Re: Dynamic user group using HIP log tagging in General Topics

Dynamic user group using HIP log tagging

Abdul_Razaq — Sun, 27 Dec 2020 09:35:57 GMT

Hi Team,

I am trying to create a Dynamic user group using Log settings for HIP logs by the following procedure,

1- created one Tag
2- Configured log settings for HIP log for build in action tagging the source user with the tag created before
3- created a dynamic group with the above tag as match criteria.

The dynamic users are not getting registered even though HIP logs are there. It is working fine for User-id logs (instead of HIP logs). i have tested in PanOS 9.1 as well as 10.0. Both versions are showing same behaviur. Have anybody faced the same ?.

Thanks in advance

Re: Dynamic user group using HIP log tagging

reaper — Mon, 28 Dec 2020 09:42:43 GMT

steps 1 and 3 should be very straight forward, but could you provide more details on step 2, as there are several variables you didn't include here

did you set any filters? remote or local userID, ...

Re: Dynamic user group using HIP log tagging

Abdul_Razaq — Mon, 28 Dec 2020 13:19:07 GMT

Hi @reaper

Just added log settings for HIP match logs with builtin action tagging source user with the tag created, no log filter is used.

tagging source user,

Target : - user

Action :- Add tag

Registartion :- Local User-ID

Timeout :- 20 min

Tag :- Tag created in first step

Re: Dynamic user group using HIP log tagging

reaper — Tue, 29 Dec 2020 11:54:47 GMT

have you verified logs are actually being created/forwarded that should trigger this tag?

try adding a syslog or email profile to the same rule as the 'built-in action' rule to make sure there's actually logs

Re: Dynamic user group using HIP log tagging

Abdul_Razaq — Tue, 29 Dec 2020 12:46:41 GMT

Hi @reaper ,

Thanks!.

I can see the logs are created in HIP match logs under the monitor tab.

When I have a similar setup for user-id logs, I can see the dynamic user group is getting populated along with the new entry in 'user-id' logs.

i can see the email alert as well if I configure the email receiver.

One thing to notice is the user-id logs have 'user' column but the HIP log has 'source user', not sure this is causing the issue in the background.

Re: Dynamic user group using HIP log tagging

raghavan — Wed, 30 Dec 2020 15:30:20 GMT

Back in ClearPass version 6.5 released in March 2015, some new features were added and a couple of older
features modified to improve their function.
Policy Manager, when it’s aware of the posture/health for an endpoint, can share this information with Palo
Alto. ClearPass gathers different health class information from the OnGuard client, context such as the state
of the endpoint firewall (enabled/disabled, engine version), derives a posture state, and then returns a
healthy/un-healthy state per class back to the Palo Alto firewall. There are 10 classes that can be reported
against and they are covered later in the document.

typhoon tv

Re: Dynamic user group using HIP log tagging

Abdul_Razaq — Mon, 04 Jan 2021 14:05:43 GMT

Hi @reaper /Community

Appreciate if you were able to replicate the issue in the lab. looks like a configuration limitation to me as it is not working in any PanOS version for HIP logs.

Re: Dynamic user group using HIP log tagging

Abdul_Razaq — Mon, 15 Mar 2021 11:50:29 GMT

Hi Community,

Just confirmed with Palo Alto Engineering that 'Dynamic user group using HIP log tagging' is not currently supported. Palo Alto Documentation team is changing the document to remove HIP log support.