What difference are between 'user eq' and 'user in' in filter of traffic logs?

[KiCheon.Lee]

Hello,

What difference are between 'user eq' and 'user in' in filter of traffic logs?

I want to see output which is filtered by partial user-ID not full user-ID.

For example, There are as below user-IDs.

SA10001

SA10002

UQ20001

UQ20002

.......

I want to filter for all started 'SA' users in traffic logs.

KC Lee

[HULK]

Hello KC,

"eq" will try to match the exact keyword. Could you please try to use "in SA" in the filter (partial match keyword). Please find mentioned KB article for available options: Filtering Traffic Logs for Only Unidentified Users

Thanks

[KiCheon.Lee]

Hello HULK,

First, Thanks for your answer.

I already looked above liked document. and I also tried to use "in SA" in the filter.

But I could see nothing logs in traffic logs.

In addition, PANOS is 5.0.10.

Thanks

[RohJaewoong]

Hi cheon,

I also tried to do test and it's available but not working.

GOOD LUCK~

[bat]

Hi cheon

"User eq" looks for a exact match that you provide. "User in" however can be used to perform queries such as:

user.src in "cn=test,ou=sec_g,ou=pan,dc=paloaltonetworks,dc=local"

Thus "User in" looks if the user is part of the group.

In your case if all username starting with SA are part of a particular group you can provide a similar query.

Let me know how it works out.

Thanks

[KiCheon.Lee]

Thanks for your answer, csharma.

But we use xml method not AD with LDAP.

In case, How should I use filtering?

Thanks

[bat · Accepted solution]

cheon

You can do the same thing if you are using XML API, just provide the group entry as follows:

<uid-message>

<version>1.0</version>

<type>update</type>

<payload>

<login>

<entry name="plano2003\csharma" ip="192.168.39.209" timeout="20">

</entry>

</login>

<groups>

<entry%20name="group1"> >>>>>>>>>>>>>>>>>>>>>plano2003/csharma is part of group1

<members>

<entry name="plano2003\csharma"/>

</members>

</entry>

</groups>

</payload>

</uid-message>

Now if you check the CLI:

[edit]

admin@39-PA-3020# run show user ip-user-mapping all

IP              Vsys   From    User                             IdleTimeout(s) MaxTimeout(s)

--------------- ------ ------- -------------------------------- -------------- -------------

192.168.39.209  vsys1  XMLAPI  plano2003\csharma                1194           1194

Total: 1 user

admin@39-PA-3020# run show user group list

group1 >>>>>>>>>>>>>>>>>>>>>>>group we just added

Total: 1

Now the query will be modified as follows (user.src in 'group1') where group1 is the group of the users we added through XML API.

In your case you can modify your XML API to make all users starting with 'SA' as one group and users starting with as 'UQ' as part of another group.

Let me know if you have any queries.

Thanks

[KiCheon.Lee]

Hi csharma,

Thanks for your answer.

It help me very useful.

But my customer want to filter partial characters on many groups.

Do you know another way excepted same group?

We can not category group by partial characters.

Thanks