Reports based on groups

[panos]

Hi,

When we try to get custom reports by typing a query for source user(domain\group) and run now, it gets empty.when we type user name it is working.

Any idea ?

Thanks

[UhMayYeah]

Try following query :

(user.src in 'cn=home,cn=users,dc=amb,dc=local')

OR (user.src in 'amb\home')

[panos]

we already tried both but report comes empty.

[UhMayYeah]

Can you query traffic logs  using query in above formats?

[panos]

for users yes we can query with domain\user

[dpalani]

Hi,

The log format in 3.x is

domain, receive_time, serial, type, subtype, config_ver, time_generated, src, dst, natsrc, natdst, rule, srcuser, dstuser, app, vsys, from, to, inbound_if, outbound_if, logset, time_received,

sessionid, repeatcnt, sport, dport, natsport, natdport, flags, proto, action, bytes, bytes_sent, bytes_received, packets, start, elapsed, category, padding

If the record of the group is not written to the traffic log, i suppose it is an expected behavior that the queries based on groups will return empty.

I may be wrong since its 3.x panos.

Regards,

Deepak

[UhMayYeah]

Try this :

> show user ip-user-mapping ip <ip of the user which shows up in traffic Logs>

Use the Group in the Group(s) field for the query in the traffic logs  :  (user.src in 'Group in the Group(s) field')

[panos]

Thanks.We did that.

Still reports come empty for gorups.

[apasupulati]

Hello,

Is PAN firewall retrieving the user-group information properly?

>show user group name <group name>  //this should list all the group members of the group

>show user user-IDs match user <username> //shows the groups a user is a part of.

If the firewall is able to identify the users in the group and see traffic logs for these users, it should match the query for the report.

Thanks,

Aditi