Been trying to audit our Prisma Access bandwidth costs for a few months now. The portal dashboards are too high-level—shows overall data usage by region or app, but I need to tie it back to our internal user groups for chargeback. We have contractors, finance, dev teams, all with different traffic profiles.
What I've tried/checked:
- The "Traffic Logs" in Panorama/Strata give session details, but aggregating that by our AD groups for a monthly total seems manual and clunky.
- The "App Reports" don't seem to break it down by user group, more by application category.
- Strata Cloud Manager doesn't appear to have a built-in report for "bandwidth by group" either.
Is there a specific log type or report template I'm missing? Or is the only real way to do this by pulling raw logs (like the Traffic or Tunnel logs) into something like a SIEM and building custom queries? If you've set this up, what's the practical workflow?
Specifically need:
- Ingress/egress per user group (mapped from LDAP/AD)
- Ideally per location/region
- Monthly totals for cost allocation
If the native tools can't do it, what's the most straightforward export-and-analyze method? Prefer something that doesn't require a massive Splunk investment.
cb