Changes by User

The changes by user report (formerly Palo Alto Changes by User) allows you to schedule a report to run that identifies configuration changes that have been made by a specific user during a defined time period on a Palo Alto Panorama or Check Point CMA R80 Management Station. Only added or removed (changed) objects of a modified group will be included in the report.

For Check Point CMA R80, you will need to select the Include Granular Change in Normalization check box (Management Stations > Check Point CMA R80 > Advanced).

To create and schedule this report, complete the following steps.

  1. On the toolbar, click System > Reports.
  2. Click Create > Changes By User Report.

  3. Complete the General section.

    1. The Name and Description fields are prepopulated, but can be changed.
    1. Select a Device and Device User to associate to the report.

    The Device User is the user name captured for the change user on the targeted device, not necessarily the FireMon Security Manager user name.

  4. Complete the Options section.
    1.  Select one of the Interval options for the report.
      • Select Last Revision if you want the interval to run after the last configuration revision.
      • Select Date Range if you want to the interval to run during a set period of time. Click the calendar icon to set a Start Date and End Date.
      • Select Daysif you want the interval to run after a set number of days. 30 days is the default.
    2. Click the Section Heading keys to switch from including to excluding a specific section in a report. A blue key indicates inclusion.
  5. Complete the Scheduling Properties section.
    1. Select a Recurrence from the list, and then select the Enable check box.
    2. Enter a Description (or purpose) for the schedule.
    3. Depending on the Recurrence type selected, additional required field boxes will appear.

    Repeat Interval is used to determine how often the report should run during the set Start/End Time. For example, a report set to run daily for a 30-day period with a repeat interval of 2 will run every two days during the set period.

    1. Set a Start Time and End Time. Click the calendar icon to set a day, and the clock icon to set a time.
  1. Complete the Notification Settings section.
    1. Select the Users to include. Enter the first few letters of the user's name to search the All Users list.
    2. Enter other recipients in the Additional Email Addresses field. Use a semicolon to separate multiple email addresses.
    3. Select a Report Format output of PDF or CSV.
    4. Optional. Click the Use .ZIP file for email attachment toggle key to enable this feature.
    5. Optional. Click the Sign and encrypt email toggle key to enable this feature.

    Email encryption must be setup to utilize the sign and encrypt email feature.

  2. Click Save.