Any 3rd party app for user activity report?

[SThatipelly]

Anyone using a 3rd party app to generate user activity reports from Palo logs? The report I get from Palo is not that interactive and informative.

[BPry]

@SThatipelly,

What type of report exactly are you looking for. If you offload the logs to a log collector of some type there are plenty of different applications/add-ons/custom things you can do with the information. We kind of need to know what you are looking for to recommend anything though. 

[SThatipelly]

I am looking for a tool that can give me detailed user activity report of a user. It should help me in doing forensics.

[BPry]

@SThatipelly,

Again, details are key here and we need them to recommend a product. This means that we need to actually know what you are looking for in the report that you are wishing to generate. Do you want to be able to tell how much time someone spends in a website category? Do you want to keep track of how much time someone spends at a base URL? Is the current built-in user activity report good enough in a detail perspective, but it doesn't look nice enough to present to leadership? Maybe you are looking for something more like a SOC solution? 

[SThatipelly]

@BPry  what you had mentioned in your response is exactly what i am looking but not like a SOC solution. I will be using it just for reporting purposes. Please suggest me a tool.

[OtakarKlier]

Hello,

Any SIEM tool should be able to provide the basics.

Hope that helps.

[BPry]

@SThatipelly ,

As @OtakarKlier mentioned this is table stakes for any SIEM and something that can be built out in pretty much anything. As you haven't said exactly what you are looking for, the easiest solution right out of the box would be Splunk with the Palo Alto plugin. That will give you a basic dashboard and you can built the more detailed reports as you see fit. 

[SThatipelly]

we currently have Qradar that is doing basic Palo alto traffic reporting. but my upper management wants to have a reporting tool that can give detailed info about a user activity report(not much interested in whole traffic stats).