Dynamic User Groups
Dynamic
user groups help you to create policy that provides auto-remediation
for anomalous user behavior and malicious activity while maintaining
user visibility. Previously, quarantining users in response to suspicious activity
meant time- and resource-consuming updates for all members of the
group or updating the IP address-to-username mapping to a label
to enforce policy at the cost of user visibility, as well as having
to wait until the firewall checked the traffic. Now, you can configure
a dynamic user group to automatically include users as members without
having to manually create and commit policy or group changes and
still maintain user-to-data correlation at the device level before
the firewall even scans the traffic.
To determine what users
to include as members, a dynamic user group uses tags as filtering
criteria. As soon as a user matches the filtering criteria, that
user becomes a member of the dynamic user group. The tag-based filter
uses logical and and or operators. Each
tag is a metadata element or attribute-value pair that you register
on the source statically or dynamically. Static tags are part of
the firewall configuration, while dynamic tags are part of the runtime
configuration. As a result, you don’t need to commit updates to
dynamic tags if they are already associated with a policy that you
have committed on the firewall.
To dynamically register tags,
you can use:
- the XML API
- the User-ID agent
- Panorama
- the web interface on the firewall
After you create
the group and commit the changes, the firewall registers the users
and associated tags then automatically updates the dynamic user
group’s membership. Because updates to dynamic user group membership
are automatic, using dynamic user groups instead of static group
objects allows you to respond to changes in user behavior or potential
threats without manual policy changes.
The firewall redistributes
the tags for the dynamic user group to the listening redistribution
agents, which includes other firewalls, Panorama, or a Dedicated
Log Collector, as well as Cortex applications.
The
firewall redistributes the tags for the dynamic user group to the
next hop and you can configure log forwarding to
send the logs to a specific server. Log forwarding also allows you
to use auto-tagging to automatically
add or remove members of dynamic user groups based on events in
the logs.
To support
redistribution for dynamic user group tags, all firewalls must use
PAN-OS 9.1 to receive the tags from the registration sources.
Because the dynamic user group itself is static,
but the group’s membership is dynamic, this allows flexibility with
policy creation. For example, if you want the members of the group
to return to their original groups after a specific duration of
time, configure a timeout for the group. It also allows you to implement
information about user behavior from other applications by tagging
information from these sources, which updates the dynamic user group
membership.
The following example demonstrates how to configure
a dynamic user group to deny traffic to users when the firewall
detects traffic to questionable sites and use the dynamic user group
in a policy to automatically deny traffic to users accessing these
sites. The example workflow shows how to configure a dynamic user
group that includes users based on their questionable activity and
enforce a Security policy for those users that denies access, regardless
of the user’s device or location, so that when user behavior matches
the tags you specify, the firewall adds the user to the dynamic
user group and applies the associated policy to deny access.
- SelectandObjectsDynamic User GroupsAdda new dynamic user group.
- Define the membership of the dynamic user group.Create dynamic tags to specify the criteria for members of the dynamic user group. When a user matches the criteria, the firewall adds the user to the group.
- Enter aNamefor the group.
- (Optional) Enter aDescriptionfor the group.
- (Panorama only) To share the match criteria of the dynamic user group with all device groups on Panorama, enableShareddynamic user groups.When you enable this option, theLocationcolumn displays whether the match criteria for the dynamic user group is available to every device group on Panorama (Shared) or to the selected device group.When you enable this option, Panorama shares the match criteria of the dynamic user group; Panorama does not share the group members.
- (Panorama only) To prevent administrators from overriding the settings of this dynamic user group in device groups that inherit the object, enable theDisable overrideoption.
- Add Match Criteriausing dynamic tags to define the members in the dynamic user group.For this example, enterquestionable-activity.
- (Optional) Use theAndorOroperators with the tags that you want to use to filter for or match against.
- ClickOK.
- (Optional) Select theTagsyou want to assign to the group itself.This tag displays in theTagscolumn in theDynamic User Grouplist and defines the dynamic group object, not the members in the group.
- ClickOKandCommityour changes.If you update the user group object filter, you must commit the changes to update the configuration.
- Depending on the log information that you want to use as match criteria, create a log forwarding profile or configure the log settings.
- For Authentication, Data, Threat, Traffic, Tunnel Inspection, URL, and WildFire logs, create a log forwarding profile. This performs the user-to-tag mapping at the device level so that the firewall applies the policy before the firewall detects the traffic.
- SelectandObjectsLog ForwardingAdda log forwarding profile.
- Enter aNamefor the log forwarding profile thenAddtheBuilt-in Actionsyou want the firewall to take.
- SelectUseras theTarget.
- (Optional) To return dynamic user group members to their original groups after a specific duration of time, enter aTimeoutvalue in minutes (default is 0, range is 0-43200).
- Specify theTagsthat define the criteria for the members of the dynamic user group. For this example, enterquestionable-activity.
- For User-ID, GlobalProtect, and IP-Tag logs, configure the log settings. This performs the user-to-tag mapping at the traffic level so that the firewall applies the policy when it detects the user’s traffic.
- Select.DeviceLog Settings
- Select the type of log that contains the information you want to use for the match criteria andAddit.
- Enter aNameandAddyourBuilt-in actions.
- Enter aNamefor each action and selectUseras theTargetfor each action.
- Select theRegistrationsource.
- (Optional) To return dynamic user group members to their original groups after a specific duration of time, enter aTimeoutvalue in minutes (default is 0, range is 0-43200).
- Specify theTagsthat define the criteria for the members of the dynamic user group. For this example, enterquestionable-activity.
- Use the dynamic user group in a policy to regulate traffic for the members of the group.You will need to configure at least two rules: one to allow initial traffic to populate the dynamic user group and one to deny traffic for the activity you want to prevent (in this case,questionable-activity). To tag users, the rule to allow traffic must have a higher rule number in your rulebase than the rule that denies traffic.
- Select.PoliciesSecurity
- ClickAddand enter aNameand optionally add theTagsthe policy uses.
- Add theSource Zoneto specify the zone where the traffic originates.
- For theSource User, select the dynamic user group from Step 1.
- Add theDestination Zonewhere the traffic terminates.
- Select theService/URL Categoryfor the type of traffic you want to prevent.For this example, selectquestionablefor the rule that denies the traffic.
- Specify theAction.For the rule that denies traffic to the dynamic user group members, selectDeny.
- Clonethis rule andDeletethequestionableService/URL Category, then selectAllowas theActionto create the rule that allows the traffic to populate the dynamic user group members.
- If you configured aLog Forwardingprofile in Step 3, select it to add it to the policy.
- Commityour changes.
- (Optional) Refine the group’s membership and define the registration source for the user-to-tag mapping updates.If the initial user-to-tag mapping retrieves users who should not be members or if it does not include users who should be, modify the members of the group to include the users for whom you want to enforce the policy and specify the source for the mappings.
- In theUserscolumn, selectmore.
- Register Usersto add them to the group and select theRegistration Sourcefor the tags and user-to-tag mappings.
- Local(Default)—Register the tags and mappings for the dynamic user group members locally on the firewall.
- Panorama User-ID Agent—Register the tags and mappings for the dynamic user group members on a User-ID agent connected to Panorama. If the dynamic user group originates from Panorama, the row displays in yellow and the group name, description, match criteria, and tags are read-only. However, you can still register or unregister users from the group.
- Remote device User-ID Agent—Register the tags and mappings for the dynamic user group members on a remote User-ID agent. To select this option, you must first configure an HTTP server profile.
- Select theTagsyou want to register on the source using the tags you used to configure the group.
- (Optional) To return dynamic user group members to their original groups after a specific duration of time, enter aTimeoutvalue in minutes (default is 0, range is 0-43200).
- AddorDeleteusers as necessary.
- (Optional)Unregister Usersto remove their tags and user-to-tag mappings.
- Verify the firewall correctly populates the users in the dynamic user group.
- Confirm theDynamic User Groupcolumn in the Traffic, Threat, URL Filtering, WildFire Submissions, Data Filtering, and Tunnel Inspection logs displays the dynamic user groups correctly.
- Use theshow user group list dynamiccommand to display a list of all dynamic user groups as well as the total number of dynamic user groups.
- Use theshow object registered-user allcommand to display a list of users who are registered members of dynamic user groups.
- Use theshow user group namecommand to display information about the dynamic user group, such as the source type.group-name
- Monitor the users in your dynamic user groups to track user activity.
- Generate user activity reports for members of dynamic user groups () to determine if more malicious activity occurs.MonitorPDF ReportsUser Activity Report
Most Popular
Recommended For You
Recommended Videos
Recommended videos not found.