Config Audit PDF Report

Reply
Highlighted
L1 Bithead

Config Audit PDF Report

Hi all lovely people of Palo Alto Live,

 

I want to see if there is a way to generate a custom (or in-built) report for the config changes on the Palo Alto?

For example, the requirement is that a weekly report is needed on what changes are made by which administrators in the past week, or the difference in config between today and the config 7 days ago.

 

As of now, I don't see any option from the GUI of Palo Alto.

Your help is greatly appreciated,

 

Thanks a Bunch!

 

 


Accepted Solutions
Highlighted
Community Team Member

Re: Config Audit PDF Report

Hi @MHamad,

 

Currently there is no such feature.  There is already a feature request for it (ID 986).

Please reach out to your local SE and ask him to add your vote.

 

In the meantime you could use the mentioned method from the previous comments.

Alternatively you could try getting the info using API calls.

 

For example the following API call will return a job ID (note that you will have to edit the query or script it to match your timeframe) :

 

https://xxxxxxxxx/api/?type=log&log-type=config&key=xxxxxxxxxxxxxxxxxxxx&query=(%20receive_time%20geq%20%272016/12/18%2016:11:04%27%20)

 

>> query job enqueued with jobid 945

 

Use the job-ID that you got from the previous call to get the info in a 2nd API call :

 

https://xxxxxxxxx/api/?type=log&action=get&job-id=945&key=xxxxxxxxxxxxxxxxxxxx

 

>> this should return an XML output of your query.

 

 

Another possibility would be to forward all your config log to a syslog server or just mail it to you and parse it outside the firewall.

 

Cheers !

-Kim.

View solution in original post


All Replies
Highlighted
Community Team Member

Re: Config Audit PDF Report

Hi @MHamad,

 

With the 'Config Audit' option you can easily compare any configuration version.

You find the option under Device > Config Audit

 

Config AuditConfig Audit

 

Also, the configuration logfile will provide you more information on specific changes made by specific administrators :

 

Configuration LogConfiguration Log

Cheers,

-Kim.

 

Highlighted
L1 Bithead

Re: Config Audit PDF Report

Hi Kiwi,

Yes that option is well known. Just looking for a way to get a report preferably PDF and have it scheduled weekly.

Thanks,
Highlighted
Community Team Member

Re: Config Audit PDF Report

Hi @MHamad,

 

Currently there is no such feature.  There is already a feature request for it (ID 986).

Please reach out to your local SE and ask him to add your vote.

 

In the meantime you could use the mentioned method from the previous comments.

Alternatively you could try getting the info using API calls.

 

For example the following API call will return a job ID (note that you will have to edit the query or script it to match your timeframe) :

 

https://xxxxxxxxx/api/?type=log&log-type=config&key=xxxxxxxxxxxxxxxxxxxx&query=(%20receive_time%20geq%20%272016/12/18%2016:11:04%27%20)

 

>> query job enqueued with jobid 945

 

Use the job-ID that you got from the previous call to get the info in a 2nd API call :

 

https://xxxxxxxxx/api/?type=log&action=get&job-id=945&key=xxxxxxxxxxxxxxxxxxxx

 

>> this should return an XML output of your query.

 

 

Another possibility would be to forward all your config log to a syslog server or just mail it to you and parse it outside the firewall.

 

Cheers !

-Kim.

View solution in original post

Highlighted
Cyber Elite

Re: Config Audit PDF Report

Hello,

I also would like this feature, however in the meantime I am jsut using the logs. Go to Montior->Logs->Configuration. Then filter it to your time frame and export as a csv, then save as a pdf. Its a few extra steps, but shows what was done and by which admin.

 

Hope this helps.

L4 Transporter

Re: Config Audit PDF Report

@kiwiThanks for the API guidance. I tried the queries and it provides the xml output. The issue for me however is that the xml log contains only 20 entries (like the page view). Is there any way to receive "all entries"?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!