Focus

Configure Tracking of Administrator Activity

Table of Contents

Reference: Web Interface Administrator Access

Configure Tracking of Administrator Activity

Track activity of firewall administrators on the web interface or CLI for auditing purposes.

Track administrator activity on the firewall web interface and CLI to achieve real time reporting of activity across your firewall. If you have reason to believe an administrator account is compromised, you have a full history of where this administrator account navigated throughout the web interface or what operational commands they executed so you can analyze in detail and respond to all actions the compromised administrator took.

When an event occurs, an audit log is generated and forwarded to the specified syslog server each time an administrator navigates through the web interface or when an operational command is executed in the CLI. An audit log is generated for each navigation or commend executed. Take for example if you want to create a new address object. An audit log is generated when you click on Objects, and a second audit log is generated when you then click on Addresses.

Audit logs are only visible as syslogs forwarded to your syslog server and cannot be viewed in the firewall web interface. Audit logs can only be forwarded to a syslog server, cannot be forwarded to Cortex Data Lake (CDL), and are not stored locally on the firewall.

Configure a syslog server profile to forward audit logs of administrator activity on the firewall.
This step is required to successfully store audit logs for tracking administrator activity on the firewall.
1. Log in to the firewall web interface.
2. Configure a syslog server profile.
Configure tracking of administrator activity.
1. Select DeviceSetupManagement and edit the Logging and Reporting Settings.
2. Select Log Export and Reporting.
3. In the Log Admin Activity section, configure what administrator activity to track.
  Operational Commands—Generate an audit log when an administrator executes an operational or debug command in the CLI or an operational command triggered from the web interface. See the CLI Operational Command Hierarchy for a full list of PAN-OS operational and debug commands.
  UI Actions—Generate an audit log when an administrator navigates throughout the web interface. This includes navigation between configuration tabs, as well as individual objects within a tab.
  For example, an audit log is generated when an administrator navigates from the ACC to the Policies tab. Additionally, an audit log is generated when an administrator navigates from ObjectsAddresses to ObjectsTags.
  Syslog Server—Select a target syslog server profile to forward audit logs.
4. Click OK
5. Select Commit.

Configure API Key Lifetime

Reference: Web Interface Administrator Access