Ability to report on user web searches

[pmcglinchey]

I work in a large K-12. We had used Blue Coat for our Web Security/Proxy before moving entirely to PAN. With Blue Coat we had the ability to produce reports on users search terms. Does anyone know if this is possible within PAN-OS?

Thank you,

Patrick

[amcafee]

Did you ever figure out a method for reporting user search queries through the Palo Alto firewall?

[OtakarKlier]

Hello,

I could be wrong, however it only logs what url's the person visited not what they typed into a search bar.

Regards,

[Raido_Rattameister]

Try to find something that stands out in search query.

For example if you search Palo Alto Networks in Chrome search term is:

https://www.google.co.uk/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=palo%20alto%20network...

So you could start with something like:

( url contains 'www.google' ) and ( url contains 'q=' ) and !( url contains 'doubleclick' )

[OtakarKlier]

Or perhaps something like safe search. While it may not report on what is typed, it may prevent the kids from seeing things they shouldnt...

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/url-filtering/enable-safe-search-enf...

Just another thought...

[Raido_Rattameister]

Also keep in mind that if you don't decrypt then URL log shows only www.google.com/ as this is visible on the certificate.

Actual search term goes inside encrypted payload.

[amcafee]

Thanks for the good info.

Build in reporting of search queries, especially suspicious keywords, would be a nice feature to add for K-12 customers who need to stay CIPA compliant.

We still like our PA-3020 though, for all the other great work it does for us. 

[dannon]

Agreed.

We have been wanting this feature for 3 years now and have brought it up to Palo and logged it as a feature request.  It must not be a priority for Palo.

The best product in this regard was Lightspeed Systems content filter.  They have a very nice reporing system and logging layout.  It would also log keyword searches by user and give daily reports and real-time data on them.  Sadly, the rest of the product wasn't great, but reports and kwd searches/reports were spot-on.

I'd love to have this in Palo.  I hate their reporting and have wanted an overhaul since the beginning.  Being a K12 school district, we have different needs than corporate sector.

[amcafee]

+1 on Lightspeed Rocket being great at reporting details. We are needing to refresh our Rocket appliance hardware this year. $20k for a new appliance and 1 year of web filtering, and MDM. I'd gladly put that funding toward a redundant PA-3020 if PAN-OS were more configurable for K-12 environments.