Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
About Dshackelford
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About Dshackelford
08-18-2015
15Posts
1Like
0Solutions
Aug 18, 2015Last Visited
User
Activity
User
Profile
Latest posts by Dshackelford
| Subject | Views | Posted |
|---|---|---|
| 1363 | 03-13-2012 11:24 AM | |
| 1501 | 03-12-2012 12:08 PM | |
| 957 | 10-07-2011 02:00 PM | |
| 1161 | 10-06-2011 01:15 PM | |
| 729 | 08-22-2011 10:23 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 08-12-2011 10:15 AM |
User Badges
Community Statistics
| Member Since | 08-01-2011 12:06 PM |
| Date Last Visited | 08-18-2015 09:07 AM |
| Posts | 15 |
| Total Likes Received | 1 |
03-13-2012
11:24 AM
Thank you, that is helpful. I will just use the description field, or an external source for cross reference.
... View more
03-12-2012
12:08 PM
I am using the REST API to create address records and adding them to an address group. I would like to keep track of when each address was created, and I noticed that there is an attribute of "time" on both the entry and the elements in the entry for items added in the last commit. But, older items do not seem to have these attributes. Is there a way that I can set them at entry creation time that will stick around? My goal is to be able to parse these attributes later and prune old ones after a given amount of time. My current planned work around is to use the description element to hold the creation date, but that will prevent me from using the description element for an actual description. So, is there any way for me to permanently set the time attribute on these elements? Thanks, -- Daniel
... View more
- Tags:
- api
10-07-2011
02:00 PM
What I ended up doing was restricting the authentication profile for captive portal to specific groups, and that seems to make sure they ended up with the group memberships. It was a better solution than I expected because it also restricted the captive portal use to only accounts that were people.
... View more
10-06-2011
01:15 PM
We are using the UserID agents on our servers for ID and groups. Users that login via our AD domain on bound machines are correctly identified and we can apply policies based on group membership. That all works very nicely. We just put captive portal in place that uses Kerberos for authentication against AD. Users are authenticated, but policies that are based on group membership are not applied. Is there a disconnect between the two sources that keeps the groups from applying to users that are authenticated via captive portal?
... View more
Labels:
- Labels:
-
User-ID
08-22-2011
10:23 AM
In this case, the addresses cannot be represented by subnets or vlans as they are individual nodes across all our subnets and vlans. I noticed in the config that there is a stated limit of 10,000 under config/devices/platform/limits but I also noticed that in the same area there is a limit of 500 addresses in an address-group. I will take this as the practical limit for us.
... View more
08-19-2011
01:50 PM
The UAR includes a section called Browsing Summary by Website that produces exactly the data I want. It does not count the times that a specific URL was accessed, but how many times a specific site was accessed. The UAR seems to have generated fields from the URL log that are not available in the custom reports.
... View more
08-19-2011
08:26 AM
I am using PoSh at the moment, but portlets will probably be written in .Net. I am looking to have something like the following: Website Repeat Count www.playb0y.com 450 www.otherxxxsite.com 234 www.foreignxxxsite.fr 43 www.somexxxstreamingsite.com 15 These are the actual host names from the URLs, rather than the resolved host names from an IP. We want to know what site the user was actually visiting, not just which IP, or shared host. I am pretty sure I can do the work on my end by pulling a report of repeat count per destination IP, and then grabbing and matching each IP to a URL in order to pull the host name. But getting the URLs associated with an IP might be the hard part if it is a separate report. I am also sending all URL filtering logs into Splunk, and can use Splunk's API to pull the data realtime with all the details already indexed and ready to be formated, but I would rather not depend on an external tool if I don't have to. By the way, the image of the widget in your post does not show up for me.
... View more
08-18-2011
02:06 PM
Ha! Yes, that is almost exactly what I am looking for. I need to get an easy way to see the repeat counts for a particular recognizable site. I can get a count for a destination IP, or resolved address but that is meaningless to the user, but not the actual hostname from the URL. Yet, the user activity report includes this, which is why I was trying to find a way to run and retrieve it.
... View more
08-18-2011
01:00 PM
I have been able to create a new user report via the API, but have not found a way to run the report and retreive the generated pdf. Is this completely beyond the bounds of the API? The reason I am trying to do this is because we have two separate user bases that need monitoring and action: students and faculty. Each has it's own path to resolution involving different areas (Student Development for students, and HR for faculty/staff). I would really like to give them rights to generate their own reports for users, but they would share the same reporting area, and be able to see reports for the user base they are not responsible for. This is primarily a problem with the staff in Student Develpment being able to run reports on other faculty and staff. So, I want to use the API to generate the user reports dynamically and on demand. I can create a portlet in our portal that gives access to reports for specific users (ie. the ones that have already shown up in blocked URL reports) so that the person responsible can handle disputes that arise. If the list only includes the users that they should be able to view, the portlet can create the user activity report on the fly, but I need a way to retreive the actual report. I guess the second suggestion would be ACLs for managing access to reports.
... View more
08-18-2011
09:41 AM
What is the performance impact of having many addresses to match against? If I have an address group that has hundreds of individual addresses in it (some FQDN), others ip netmask, will it have a noticible impact on performance? We are using a 2050 primarily for URL filtering.
... View more
08-18-2011
09:16 AM
I now have a script that looks at the top x unauthenticated blocked users in the last 24 hours, and if the repeat count is high enough, it creates an address entry for the ddns FQDN address (so it follows them), adds that address to an address group, which has a captive portal rule applied to force authentication. That way, "good" users are not forced to authenticate, and "bad" users are.
... View more
08-18-2011
05:32 AM
That did it! I am on my way to dynamic and automated management of access! Thanks Novidys.
... View more
08-17-2011
03:28 PM
That's great! I am looking forward to seeing that primer. That is one of our workflows that we hope to setup, but there are others that I would like to implement once I can fully utilize the API.
... View more
08-12-2011
10:25 AM
I can give details of what I actually am trying to do: 1. Custom report that tells me top source IPs of blocked traffic 2. Use API to retrieve list 3. Based on list, create an address object for each source IP 4. Add each address object to an address group that is denied access The the deny rule and the address group is already setup, I just need a way for my scripts to manage the addresses in the address group.
... View more
08-12-2011
10:15 AM
1 Kudo
Howdy, I have been using the REST interface for pulling reporting and config data using constructed URLs in scripts. All that works well. What I have been unable to do is use the set action for config. I am using a key generated for a sysadmin user, but consistently get an "Unauthorized request" message: <response status="unauth" code="16"> <msg>
<line>Unauthorized request</line>
</msg> </response> I am using the syntax from the Using the XML API document to send the request: https://server/esp/restapi.esp?type=config&action=set&key=oursecretkey&xpath=devices/entry/vsys/entry/address/entry [@name='test']&element=<fqdn>test.domain.edu</fqdn> Is this incorrect? Is there more documentation somewhere that can give more detail on how these API URLs should be constructed? I am using PANOS 4.0.4 Thank you, Daniel
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-18-2015
09:07 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2021 - Palo Alto Networks
