Hi everyone! I've been lurking here for a while, trying to absorb all the NGFW wisdom. It's honestly a lot to take in, but this community has been super helpful. 😅
I've been using Palo Alto firewalls for about a year now, and while the built-in Panorama dashboards are great, I always felt a bit overwhelmed by the data. I wanted something a bit more visual and tailored to what *I* care about—like tracking threat activity, top applications, and bandwidth usage over time in a way that's easier for me to parse.
So, I spent a few weekends learning Grafana and finally built a custom dashboard that pulls directly from our firewall logs! It's nothing too fancy, but it really helps me see patterns. I set it up to show things like:
- Threat alerts by severity over the last 7 days
- A breakdown of denied traffic by application (super eye-opening!)
- Top source countries for traffic (we have a remote team)
- Interface throughput on a simple graph
I used the Elasticsearch plugin since that's where we ship our logs. The setup was a bit tricky at first, but once I got the queries right, it all came together.
I'm still very much a beginner with both PAN and Grafana, so I'm sure it could be improved. But I was really proud of it and wanted to share. Has anyone else here built custom dashboards? I'd love to hear what metrics you find most useful to track, or if you have any tips for making the data even clearer!
✌️ annie