Trisul Network Analytics
Developer Zone

**This is an old revision of the document!** ----

====== How to leverage Palo Alto User-ID and App-ID in Netflow analytics ====== Palo Alto firewalls are capable of exporting two very useful pieces for information in its Netflow export. The User-ID((User-ID Overview https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/user-id.html)) and App-ID ((App-ID documentation https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/app-id.html)) fields are added per-flow - User-ID : harvested from a number of mechanisms to map IP-Addresses to user names. The primary method is to interface with Microsoft Exchange / AD servers. - App-ID : the firewall deploys some heuristics to identify exact traffic types (eg Facebook, Google, Whatsapp) These two fields really turbo charge your visibility and investigation capabilities. This article explains how to leverage these in Trisul Network Analytics.