Changes by User

The changes by user report (formerly Palo Alto Changes by User) allows you to schedule a report to run that identifies configuration changes that have been made by a specific user during a defined time period on a Palo Alto Panorama or Check Point CMA R80 Management Station. Only added or removed (changed) objects of a modified group will be included in the report.

For Check Point CMA R80, you will need to select the Include Granular Change in Normalization check box (Administration module > Management Stations > Check Point CMA R80 > Advanced).

To run this report, complete the following steps.

1. On the toolbar, click Reports > Reports Library.

2. In the Reports Library table, click Changes by User Report.

3. Complete the General section.

   1. The Name and Description fields are prepopulated, but can be changed.
   2. Select a Device and Device User to associate to the report.

   The Device User is the user name captured for the change user on the targeted device, not necessarily the FireMon Security Manager user name.

4. Complete the Options section.
   1.  Select one of the Interval options for the report.
      • Select Last Revision if you want the interval to run after the last configuration revision.
      • Select Date Range if you want to the interval to run during a set period of time. Click the calendar icon to set a Start Date and End Date.
      • Select Daysif you want the interval to run after a set number of days. 30 days is the default.
   2. Click the Section Heading keys to switch from including to excluding a specific section in a report. A blue key indicates inclusion.
5. Select HTML, PDF, or CSV as the Report Format export type.
6. Click Run Report.