What difference are between 'user eq' and 'user in' in filter of traffic logs?

Reply
L4 Transporter

What difference are between 'user eq' and 'user in' in filter of traffic logs?

Hello,

What difference are between 'user eq' and 'user in' in filter of traffic logs?

I want to see output which is filtered by partial user-ID not full user-ID.

For example, There are as below user-IDs.

SA10001

SA10002

UQ20001

UQ20002

.......

I want to filter for all started 'SA' users in traffic logs.

KC Lee

Tags (2)
L7 Applicator

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

Hello KC,

"eq" will try to match the exact keyword. Could you please try to use "in SA" in the filter (partial match keyword). Please find mentioned KB article for available options: Filtering Traffic Logs for Only Unidentified Users

Thanks

L4 Transporter

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

Hello HULK,

First, Thanks for your answer.

I already looked above liked document. and I also tried to use "in SA" in the filter.

But I could see nothing logs in traffic logs.

In addition, PANOS is 5.0.10.

Thanks

L3 Networker

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

Hi cheon,

I also tried to do test and it's available but not working.


GOOD LUCK~

Highlighted
bat
L5 Sessionator

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

Hi cheon

"User eq" looks for a exact match that you provide. "User in" however can be used to perform queries such as:

user.src in "cn=test,ou=sec_g,ou=pan,dc=paloaltonetworks,dc=local"

user_in.jpg

Thus "User in" looks if the user is part of the group.

In your case if all username starting with SA are part of a particular group you can provide a similar query.

Let me know how it works out.

Thanks

L4 Transporter

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

Thanks for your answer, csharma.

But we use xml method not AD with LDAP.

In case, How should I use filtering?

Thanks

bat
L5 Sessionator

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

cheon

You can do the same thing if you are using XML API, just provide the group entry as follows:

<uid-message>

<version>1.0</version>

<type>update</type>

<payload>

<login>

<entry name="plano2003\csharma" ip="192.168.39.209" timeout="20">

</entry>

</login>

<groups>

<entry%20name="group1"> >>>>>>>>>>>>>>>>>>>>>plano2003/csharma is part of group1

<members>

<entry name="plano2003\csharma"/>

</members>

</entry>

</groups>

</payload>

</uid-message>

Now if you check the CLI:

[edit]

admin@39-PA-3020# run show user ip-user-mapping all

IP              Vsys   From    User                             IdleTimeout(s) MaxTimeout(s)

--------------- ------ ------- -------------------------------- -------------- -------------

192.168.39.209  vsys1  XMLAPI  plano2003\csharma                1194           1194

Total: 1 user

admin@39-PA-3020# run show user group list

group1 >>>>>>>>>>>>>>>>>>>>>>>group we just added

Total: 1

Now the query will be modified as follows (user.src in 'group1') where group1 is the group of the users we added through XML API.

user_in_XML.JPG

In your case you can modify your XML API to make all users starting with 'SA' as one group and users starting with as 'UQ' as part of another group.

Let me know if you have any queries.

Thanks

L4 Transporter

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

Hi csharma,

Thanks for your answer.

It help me very useful.

But my customer want to filter partial characters on many groups.

Do you know another way excepted same group?

We can not category group by partial characters.

Thanks

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!