Dynamic user group using HIP log

[Abdul_Razaq]

Hi Team,

Just need to check if anybody faced the below issue in PanOS 10.0.x

I am trying to create a dynamic user group with HIP log by following settings,

1- created one Tag

2- Configured log settings for HIP log for build in action tagging the source user with the tag created before

3- created a dynamic group with the above tag as match criteria.

The dynamic users are not getting registered eventhough HIP logs are there.

When I do the same configuration for User-ID logs, things are working fine and I can see dynamic user registration is happening.

Thanks in advance.

[nikoolayy1]

If the log forwarding profile is working for the User-ID and tagging the IP address/user and not for the HIP it could be a bug so check with the TAC. Also you can use custom signatures for vulnerability to trigger and informational message with an action Alarm (not block) in the Threat logs and use that as a signal for the Log Forwarding to tag the username. In this case the log forwarding profile will be attached on the firewall rule.