Deny authorization request for '_telemtryuser'

[P.Betts]

The other night I got a system alert email with the following message (truncated for obvious reasons):

type: SYSTEM
subtype: general
module: general
severity: high
opaque: Deny the authorization request for the admin user thru CLI, '__telemetryuser' from 'Console or telnet'

I found the article regarding the existence of _telemetryuser (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000fyZnKAI). However I'm confused as to why this account needs the Device Administrator role and not something more restrictive such as Device Administrator (Read-Only)

From what I've also gathered is that many people have been able to remove the account with little to no impact to their own environment but I'm weary to remove it from my firewalls. Does anyone know how this account is utilized to send the telemetry data back to Palo Alto Networks? How are its credentials secured? I feel like this account is just a potential vector for bad actors.

[JayGolf]

Hi @P.Betts ,

The way Telemetry works is that the internal account executes specific CLI commands and accesses internal data sources, such as log files, before aggregating the data that gets sent to Palo Alto Networks. That is why it needs more than read-only access. It needs the required privileges to kick off the Telemetry collection process and gather the needed diagnostic output.

If you do not care about Telemetry, then yes, you can disable it. However, if Telemetry is still enabled, the telemetry admin account will be recreated during the next reboot or autocommit. If you disable Telemetry and then remove the account, you should not have to worry about it being recreated.

The account is internal and dedicated solely to telemetry collection, not general administrative access. Also, the telemetry data itself does not collect PII, identifiable IP addresses, or usernames.