Palo Alto Reporting

I wanted to configure a weekly email report on a Palo Alto Networks firewall. “Yes, no problem”, I thought. Well, it was absolutely not that easy. ;(

While the PAN firewalls have a great GUI and a good design at all they lack an easy-to-use email reporting function, especially when compared to the FortiGate firewalls which have a great local report feature. –> If you want some stats on a weekly basis you must configure it completely from scratch. Unluckily this is not that easy since you must pass several steps for that. Therefore, I drew an outline of the Palo Alto reporting stages to have an overview of them.

I am currently running a PA-200 with PAN-OS 7.1.6.

Key Facts

• No predefined weekly report (only daily)
• For weekly reports, you must configure them manually
• Emails for a weekly report won’t have any graphs but only tables
• No possibility to generate weekly reports out of the ACC <- which is really bad, because the ACC draws very nice graphs

Palo Alto Reporting Outline

This is my sketch of the reporting menus. Hopefully it helps. The comments in red are disadvantages from my point of view. The comments in green are advantages:

Steps for a weekly Reporting Mail

In order to have a weekly reporting mail with a PDF that has some interesting stuff, proceed as follows:

1. Monitor -> Manage Custom Reports -> Add -> Load Template: For each template you are interested in, save it with a name (e.g., the same as the template to avoid confusion), check the scheduling, and set the time frame to “Last Calendar Week”. [Optional: Increase the rows/sort by value from top 10 to top 25, …]
2. Monitor -> PDF Reports -> Report Groups -> Add: Select all “Custom Reports” you just created.
3. Monitor -> PDF Reports -> Email Scheduler -> Add: Select the report group just created, an email profile and a recurrence of “Every Monday”.

Here are a few screenshots that might help:

Now, at the beginning of the week you’ll have an email with a PDF that includes all the reports over the last week.

Links

At least there are some docs from Palo Alto that describe some of the points I mentioned above:

• Whitepaper: Actionable Threat Intelligence
• Manage PDF Summary Reports
• Custom Reports

Featured image: “That was supposed to be going up, wasn’t it?” by Rafael Matsunaga is licensed under CC BY 2.0.