Hi everyone! I’m still pretty new to the security side of things—I usually work on data pipelines, so this is a bit outside my usual zone. But I’ve been tasked with setting up detailed web activity reporting for compliance (like GDPR and internal audits) using our Palo Alto NGFW, and I’m feeling a bit stuck.
I’ve got the firewall logging to Panorama, and I can see traffic logs in the monitor tab, but I’m struggling to generate the specific user-focused reports our compliance team is asking for. They want things like:
- Which users visited specific high-risk categories (like gambling or adult content)
- Time-stamped URLs accessed per user (or at least domains)
- Reports that tie internal IPs to actual usernames (we have User-ID enabled, I think?)
I tried creating a custom report in Panorama, but the output felt too broad. Is there a better way to filter and export this data? Maybe a way to send logs to a SIEM or even a database for querying? I’ve seen mentions of forwarding logs to something like Splunk or even a Snowflake table, but I’m not sure where to start on the Palo Alto side.
Also, if anyone has example setups for compliance reporting, I’d really appreciate any pointers! My background is more in Python and Airflow, so I’m wondering if I could build a pipeline to process these logs once I get them in a structured format. 😅
Thanks in advance for any help!
null
Totally get the feeling of stepping into a new domain! Since you're coming from data pipelines, you're actually in a great spot. The Panorama reporting feels broad because it's built for network teams, not analysts.
You're on the right track with the SIEM/database idea. For your needs, I'd stop trying to force Panorama's reporting and instead forward the logs. You can set up a syslog or SNMP trap server profile in Panorama to send those traffic logs (make sure User-ID and URL filtering are enabled on the policies) directly to a Splunk instance or even a cloud warehouse. That's where your data pipeline skills will shine - you can write the exact queries your compliance team wants.
One quick tip: before you build the whole pipeline, use Panorama's custom report to just verify User-ID is mapping correctly. If those fields are populated there, they'll be in the exported logs. Have you checked if your User-ID agent is properly integrated with your directory service? That's usually the first triage step.
Automate all the things
User-ID "enabled, I think?" is your first problem. If you haven't confirmed the mapping is actually working end-to-end, you'll just be reporting on IP addresses, which is useless for your audit. Check the User-ID agent logs or the firewall's mapping table before you build anything.
Everyone's default reaction is to dump logs to a SIEM. That's fine if you have the budget and the cycles to manage yet another vendor contract and data ingestion pipeline. But for a straightforward compliance ask, you might be over-complicating it. Panorama's custom reporting *can* do this if you lock down your filters.
* Create a report filtered by specific user or user-group.
* Set the threat/URL category to the high-risk ones you listed.
The output is clunky, but it'll get you the list. If that's still too broad, then yeah, look at forwarding logs. Just be ready for the storage costs.
Trust but verify.