Palo Alto Networks Certified Network Security Engineer (PCNSE)Manage and OperateMedium
A security auditor requires a weekly report of all applications categorized as 'high-risk' that have traversed the firewall, including source IP, destination IP, user, and session duration, for the last 7 days. This report needs to be automatically generated and emailed to the auditor every Monday morning. Which two Panorama features would you configure to meet this requirement?
- ADevice Group and Template Stack.
- BACC (Application Command Center) and Log Forwarding Profile.
- CPredefined Report and Syslog Server.
- DCustom Report and Scheduled Email.
Show answer & explanationAnswer & explanation
Correct answer: D. Custom Report and Scheduled Email.
Custom Reports allow defining specific filters (e.g., 'high-risk' applications) and output fields (source IP, destination IP, user, session duration). Scheduled Email functionality enables automated delivery of these reports at specified intervals.
Why the other options are wrong
- A. Device Groups and Template Stacks are for configuration management, not for generating or scheduling reports.
- B. ACC is for interactive monitoring and analysis, not scheduled reports. Log Forwarding Profile sends raw logs to an external receiver, not formatted reports.
- C. Predefined Reports might not have the exact filters or fields required. Syslog Server is for raw log collection, not formatted report generation.
Panorama Reporting
Panorama provides robust reporting capabilities, including custom reports that can be filtered and scheduled for automated delivery, enabling comprehensive security visibility and compliance.
- Custom reports allow granular data selection.
- Scheduled reports automate delivery.
- Essential for auditing and operational visibility.
Memory trick: Custom Reports are built to spec, then Scheduled Email delivers them right on time.