Dynamic user group using HIP log

Abdul_Razaq — Wed, 23 Dec 2020 06:49:48 GMT

Hi Team,

Just need to check if anybody faced the below issue in PanOS 10.0.x

I am trying to create a dynamic user group with HIP log by following settings,

1- created one Tag

2- Configured log settings for HIP log for build in action tagging the source user with the tag created before

3- created a dynamic group with the above tag as match criteria.

The dynamic users are not getting registered eventhough HIP logs are there.

When I do the same configuration for User-ID logs, things are working fine and I can see dynamic user registration is happening.

Thanks in advance.

Re: Dynamic user group using HIP log

nikoolayy1 — Sun, 21 Mar 2021 22:37:37 GMT

If the log forwarding profile is working for the User-ID and tagging the IP address/user and not for the HIP it could be a bug so check with the TAC. Also you can use custom signatures for vulnerability to trigger and informational message with an action Alarm (not block) in the Threat logs and use that as a signal for the Log Forwarding to tag the username. In this case the log forwarding profile will be attached on the firewall rule.

topic Re: Dynamic user group using HIP log in General Topics

Dynamic user group using HIP log

Re: Dynamic user group using HIP log