How to Create a User Activity Report for More Than One User
Environment
- Palo Alto Firewalls or Panorama.
- PAN-OS 8.1 and above.
- User Activity Report.
Resolution
Overview
It is possible to generate a single custom report on the Palo Alto Firewall for various activities for a particular user or create a single report for multiple user activities.
Details
Yes, This is possible by fine tuning the Query Builder under Monitor > Manage Custom Reports > Report Settings (give the appropriate settings).
- Go to the Query Builder column just below the Report setting and issue the "or" Connector so that it captures more than one user.
- Specify the Attribute as Source User and the Operator as "is present" and the Value as the "domain \username ".
- Click on Add so that the first user "user1" is added
- Repeat by giving another value and click on Add so that "user2" is added
The screenshot below shows User 1 added:
The screenshot below shows User 2 added:
The screenshot below shows Multiple Users added:
Users are added in the "or" function and will be able to see all the User Activity information in one single document. When the Run Now button is clicked a single report is generated.