With everyone working remotely nowadays, does anyone want to share their content on what a good PAN Global Protect dashboard could look like? I know there's the Palo Alto Networks app that relies on the PAN data model, for those of us that don't use that app: What panels do you like to have on your dashboard? What's your favorite visualization for VPN connections? Does anyone have some good SPL around duration time and data transferred during a session?
Just so it doesn't seem like I'm asking someone to build me a dashboard. My panels contain "Total number of users connected today", "Number of users connect to each gateway", " Number of users per department connected to VPN"
Also, when is Palo Alto going to parse out the whole VPN event (OS, host, etc) that they dump into the system logs?
Thanks in advance.
... View more
I’m trying to populate my users with the following query.
One of the issues I have is certain users don’t have the manager field filled in in AD, so I get a null value. For the manager’s that are populating the managedBy field I get the relative distinguished names (RDN) connected by commas, so I use the following | rex field=managedBy "^CN=(?\w*)," to get the sAMAccountName value.
Once I have this value I would like to a |ldapfilter on this field to return a readable first name, last name value.
The issue I have, when I try to run the |ldapfilter command it only returns the enriched data where there was a manager field value. if my total user count is 30,000 it only returns 5,000 users that have a manager value field.
I think I need to use a |eval statement before running the | ldapfilter command on the managedBy field but I’m not sure how to craft that. Essentially, I would like a search to return all 30,000 users and if a managerBy field has a value run the ldapfilter and give me a readable field.
|ldapsearch search="(&(objectclass=user)(!(objectClass=computer)))" attrs="userAccountControl,sAMAccountName,personalTitle,displayName,givenName,sn,mail,telephoneNumber,mobile,manager,department,whenCreated,accountExpires"
|rename sAMAccountName as identity, personalTitle as prefix, displayName as nick, givenName as first, sn as last, mail as email, telephoneNumber as phone, mobile as phone2, manager as managedBy, department as bunit, whenCreated as startDate
| rex field=managedBy "^CN=(?\w*),"
| ldapfilter search="(sAMAccountNAme=$Manager$)" attrs="displayName"
| rename displayName as managedBy
... View more