Getting Started: Custom Reports

by Community Manager on ‎12-30-2015 05:03 AM - edited on ‎01-30-2017 10:34 AM by (28,923 Views)

What more can my firewall do? Custom reports!

 

After configuring the firewall, enabling security policies and profiles, you can sit back and focus on other tasks, knowing that your network is secure. A good way to keep that peace of mind without constantly checking logs and searching for anomalies is to use scheduled reports to keep you posted on everything happening in your network.

 

Take a look at the video, then follow along step-by-step to configure your own custom reports.

 

 

 

Several Pre-Defined Reports are already set up for your convenience; these start creating usable report data the moment the Palo Alto Networks firewall is switched on and put into the network. In case some of these reports are not useful, you can disable and replace them with custom reports.

 

pre-defined reports

 

When you start creating a custom report, one of your first choices is which database to use for your report. You'll notice there are two groups to choose from, Summary and Detailed, each containing similar types of logs. 

 

custom report database

 

The Summary Databases are optimized databases that collect summarized data from the log files every 15 minutes, every hour, every day, and every week, allowing reports to be created quickly. The Detailed Logs allow you to crawl the log files in search of very specific data, but take longer to generate.

 

A difference between the Summary and Detailed URL database, for example, is that the Summary Database can report which categories and domains were accessed x number of times, while the Detailed Log can report exact URLs accessed from a certain source. 

 

For most reports, we recommend using the Summary Databases.

 

After selecting the database to create your report, enable the schedule and set a timeframe. An unscheduled report can  be run only manually, but allows smaller timeframes, while a scheduled report, which generates and stores reports historically, can be configured to automatically email a daily, weekly or monthly report.

 

report schedule

 

If you'd like to take a look at some sample reports, you can Load a Report Template from the predefined reports, which you can then customize. Start by loading the Top Applications template:load report template 

The Selected Columns and Database are automatically loaded from the template, you need only to change the Name and Time Frame.

loaded template

 

 

If you click the Run Now button, a sample report is generated.

example custom report

 

If you head back to the Report Settings, you can add more details to the report by adding the 'Threats' column, changing the 'Sort By' to Threats and gouping the data by Day.

custom report settings

 

If you click the Run Now button again, the report will have a completely different look: the detected threats per application are reported, the data is grouped per day, and sorted from most threats to least.

custom report

 

You can also use the Query Builder to tune the report a little further. If you want to filter out DNS and portmapper from the report, youcan create a filter for application not equal to dns and portmapper.

query builder

 

The report will now no longer contain these applications.

custom report

 

If you go ahead and click OK and Commit, the report will be added to the scheduled reports jobs that run every night and become available in the custom reports viewer:

reports viewer

 

After you've created a few of these reports, you can go ahead and add them into a report group. 

report group

 

The report group can then be added to an Email Scheduler so it is automatically mailed to you and your coworkers.

email scheduler

 

If you haven't created an Email Server Profile before, it should look somewhat like this:

email server profile

 

 

You can send a test email to make sure your configuration is working as expected before committing and waiting for the first report to appear.

email scheduler

 

I hope you found this article useful. Feel free to leave a comment below or check out other episodes in this series.

 

Regards,

Tom

Comments
by bgable
on ‎09-28-2016 06:06 PM

Tom,

 

Great job, the screenshots are very helpful.   I need to manipulate the date from the reports, so, can the reports be generated as a CSV or xls file?

by Community Manager
on ‎09-29-2016 01:13 AM

Hi @bgable thanks for the comment! :)

 

each report (custom and predefined) can be exported as CSV or XML from the reports view

 

2016-09-29_10-08-29.png

by chris_phillips
on ‎03-02-2017 03:29 PM

I think you missed the point @reaper.  What if we want the emailed version of the report to be an xml or csv?  The question I have is can an automated (emailed) report be anything but pdf?

by Community Manager
‎03-02-2017 10:28 PM - edited ‎03-02-2017 11:39 PM

Hi @chris_phillips!

The previous question did not specify emailed reports ;)

The emailed reports will only be exported as PDF files. If you need an XML/CSV version you can access the reports from the GUI and export them as the desired format as illustrated above

 

If you want the option of emailing out as CSV/XML I'd recommend you reach out to your local sales team to add a feature request

 

***edit*** FR-5884 requests xls format in emailed reports

by vtan
on ‎03-31-2017 06:00 AM

The reporting feature in PAN is very powerful.  However, I find that the presentation of the reporting features to have inconsistent behavior.  When I create a custom report and schedule it, the report does not always show up in the custom report viewer...even after waiting 24 hours.  Just wondering if anyone else notice that?

 

My intention is to create a custom report...for example "top unknown-tcp" with a schedule of say last calender day or last 7 days.  Then go to the custom viewer and hopefully see that new custom report there, and select a past date to run the report against.  I do see some older custom report I created, but it seems the availability of new custom reports are inconsistent.

 

Am I not understanding how to build these custom "scheduled" or is there a bug?

 

 

by Community Manager
on ‎03-31-2017 06:30 AM

when creating a new custom report you'll need to wait for a period indicative of the timeframe you created your report (eg 'last calendar week) before a complete report can be generated

 

so for the above example, if you create this report on wednesday, you'll need to wait a week and a half, till the second monday after creating the report, before a 'full and accurate' report can be created (as the information colection is started the moment you create the report and your preferred timeframe is one business week mo-sun)

 

the run-now feature will show as much accurate data as can be gathered from the available summary data, but for true accuracy you will need to wait for the report to have sufficient runtime to present the data. these cannot be run against days in the past (prior to when the report was created)

 

if you're seeing inconsitencies after the report has been active for a while, you may want to consider upgrading if you're on a somewhat older PAN-OS, or reach out to support to verify if something is wrong

by vtan
on ‎03-31-2017 06:48 AM

@reaper Appreciate the quick response to my inquiry.  It makes better sense now on why those custom reports are not showing up.  However, is there a reason why PAN decided not to have the newly built custom report available for past dates?  So for example, if I created a report to present analytic data for the last 7 days, but I want it against a date from a couple of days ago, why would they NOT allow it to appear @ the custom report viewer, where I can select specific past dates?  I would think they could easily make it happen and just gray out dates the specific report cannot generate due to insufficient data collection. Looking at the Run Now option, they do not have the option to select past dates...

 

Just my two cents worth of opinion...

 

 

by Community Manager
on ‎03-31-2017 07:02 AM

Regarding strategy decissions I would recommend you reach out to your local sales rep. You might also have them submit a feature request to enable past-date custom reports.

The practical reason for this option not to be available, is the way summary data is collected the moment a report is created. Basically the report wil lstart to be populated with summary data the moment it is created, this is why you can't go back in the past

by ITeresco
on ‎05-07-2018 05:42 AM

Can you please advise me how to work with customreports via API?

Ignite 2018, Amsterdam, Netherlands
Ask Questions Get Answers Join the Live Community