Trisul Network Analytics
Developer Zone

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== Using Palo Alto User-ID and App-ID in Netflow analytics ======


Palo Alto firewalls are capable of exporting two very useful pieces for information in its Netflow export.  The User-ID((User-ID Overview https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/user-id.html))  and App-ID ((App-ID documentation https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/app-id.html))  fields are added per-flow 
  - User-ID  :  harvested from a number of mechanisms to map IP-Addresses to user names. The primary method is to interface with Microsoft Exchange / AD servers.
  - App-ID : the firewall deploys some heuristics to identify exact traffic types (eg Facebook, Google, Whatsapp) 

These two fields really turbo charge your visibility and investigation capabilities. This article explains how to leverage these in Trisul Network Analytics.

- monitoring overall traffic of Users and Apps
- searching individual flows for a particular User or App at flow level
- aggregate statistics of a particular User or App. 

===== Counter Groups =====

Trisul automatically creates two counter groups called User-ID and App-ID. These meter the traffic statistics continuously of these groups in the overall network. 

The metrics within the User-ID and App-ID counter groups are.




NAT issues

Create flow tags

Create dashboards

Query by user-id and app-id

Aggregate flows 

Crosskeys

Trisul Network Analytics Developer Zone

User Tools

Site Tools

Page Tools

Trisul Network Analytics
Developer Zone