How to Create a User Activity Report for More Than One User

• Palo Alto Firewalls or Panorama.
• PAN-OS 8.1 and above.
• User Activity Report.

Overview

It is possible to generate a single custom report on the Palo Alto Firewall for various activities for a particular user or create a single report for multiple user activities.

Details

Yes, This is possible by fine tuning the Query Builder under Monitor > Manage Custom Reports > Report Settings (give the appropriate settings).

1. Go to the Query Builder column just below the Report setting and issue the "or" Connector so that it captures more than one user.
2. Specify the Attribute as Source User and the Operator as "is present" and the Value as the "domain\username".
3. Click on Add so that the first user "user1" is added
4. Repeat by giving another value and click on Add so that "user2" is added

The screenshot below shows User 1 added:

The screenshot below shows User 2 added:

The screenshot below shows Multiple Users added:

Users are added in the "or" function and will be able to see all the User Activity information in one single document. When the Run Now button is clicked a single report is generated.