GlobalProtect
Configure Custom Reports for GlobalProtect in PAN-OS
Table of Contents
Configure Custom Reports for GlobalProtect in PAN-OS
You can configure custom reports for GlobalProtect in
PAN-OS.
You can configure
custom reports based on
GlobalProtect logs that the firewall generates immediately (on demand)
or on schedule (each night).
- In PAN-OS, Generate a Custom Report for GlobalProtect.
- Select .
- Click Add and then enter a Name for the report.
- To base a report on an predefined template, click Load Template and choose the template. You can then edit the template and save it as a custom report.
- If you choose to build the report from scratch, select the database you want to use for the report as Device GlobalProtect Log.
- Select the Scheduled check box to run the report each night. The report is then available for viewing in the Reports column on the side.
- Define the filtering criteria. Select the Time Frame, the Sort By order, Group By preference, and select the columns that must display in the report.
- ( Optional) Select the Query Builder attributes if you want to further refine the selection criteria. To build a report query, specify the following and click Add. Repeat as needed to construct the full query.
- Connector—Choose the connector (and/or) to precede the expression you are adding.
- Negate—Select the check box to interpret the query as a negation. If, for example, you choose to match entries in the last 24 hours and/or are originating from the untrust zone, the negate option causes a match on entries that are not in the past 24 hours and/or are not from the untrust zone.
- Attribute—Choose a data element. The available options depend on the choice of database.
- Operator—Choose the criterion to determine whether the attribute applies (such as =). The available options depend on the choice of database.
- Value—Specify the attribute value to match.
For example, to build a report for GlobalProtect portal users with unsuccessful login attempts, use a query similar to the following:((eventid eq 'portal-prelogin') or (eventid eq 'portal-auth') or (eventid eq 'portal-gen-cookie') or (eventid eq 'portal-getconfig')) and (status eq 'failure')
- To test the report settings, select Run Now. Modify the settings as required to change the information that is displayed in the report.
- Click OK to save the custom report.
