CREATE CUSTOM REPORT FOR UNKNOW USERS?

[alle]

Hello,

I want create a custom reports for identify all User there are not identified by the PALO-ALTO

I can do that with the traffic log with the fitler : not (user.src neq '') ( I do a negate on user is present)

I can see the unknow users in real time, in cli with : show user ip-user-mapping | match unknow

but with the custom report filter is not possible to use "negate" and the blank space doesnt WORK

i can juste use ( =, in, is present, not in, !=) for the source user culomn.

AND I don't know how to see wich ip no match user during a period.

any IDEA

thx

PS: when I create a report with destination hostname I see correctly the hostname but When I do an export I see the ip address not the hostname!

[dburns]

Current there is no way from the WebUI to add a custom rule with with a search value of NO user. I would send a feature request to your SE.

There is however a work around for this. The is present search string creates a value which you can change in the xml manually.

If you export your XML and search for the rule name you will see this; <query>user.src neq ''</query>. You can change the neq to eq and and reimport the config which will change the rule to user = <blank Value>, and it will search for users without username.

Hope this helps.

Dominic