How to parse GlobalProtect usernames from the System log for something like emailing a list of users

[bspilde]

How to parse GlobalProtect usernames from the System log for something like emailing a list of users

1. On the PA’s Monitor Tab click on System
2. Enter this search string
   1. ( description contains 'authenticated for user') and ( description contains 'LDAP-sAM-attribute' ) -substitute LDAP-sAM-attribute with your auth profile used specifically for the GlobalProtect authentications or use another unique contains string to limit your results to only GP users
3. Click the Excel icon to begin the export
4. Download the file when completed
5. Open Excel and create a new spreadsheet
6. Select Data | Get External Data | Import from Text File
7. Browse to your downloaded PA firewall export CSV log file and Get Data
8. On the Text Import Wizard select Delimited and Start import at row 2
9. Click Next
10. Be sure that no delimeters are selected
11. Check the Other: box and enter an apostrophe ‘
12. Now you will see a preview of the data to be imported
13. For the Column data format select (Skip) for all columns except for the column that has the usernames in it.
14. Now click Finish and OK to import in the existing sheet at the cell you would like to start with, typically =$A$1
15. Optionally you could just import ‘as is’ and delete the columns you don’t need.
16. Now we must remove any duplicates
17. Select your column of usernames
18. Click on Data and Remove Duplicates | Remove Duplicates
19. Now you may copy that column and paste it into an email recipients list
20. Click “Check Names” to verify the users match existing address book users and eliminate any that were not found.
21. Draft your message and SEND!