Email Alert on PAN/PAFW for new admin account Creation

[Adam_DiMarco]

Hi,

I am looking to create email alerts for when ANY user creates a new admin account of anytype on both our Panorama and any of our firewalls managed by panorama.  Our PAFW send/forward their logs to our M600 Panorama device.

Any have any link or suggestions?  Purpose being to know if any admin create local or alternate admin accounts, or scenario if an admin account was compromised and that intruder went to create an alternate account.

Thanks,

Adam D

[TomYoung · Accepted solution]

Hi @Adam_DiMarco ,

1. Follow steps 1 and 2 here.  You will need an SMTP Relay IP address.  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/configure-email-alerts
2. For step 3, configure the settings below under Device > Log Settings > Configuration.  If you open Filter Builder, you can test the filter with View Filtered Logs.  You can also test the filter under Monitor > Logs > Configuration.

If you are forwarding all of your configuration logs to Panorama, you only have to do it once on Panorama.  It also catches administrators configured in a template.

Thanks,

Tom

[Adam_DiMarco]

Thanks Tom, just configured that and tested it out and got an email notification.