162
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Use
Panorama
for
Visibility
Monitor
Network
Activity
Change
Data
Source
—The
default
source
used
to
display
the
statistics
on
the
charts
in
the
ACC
is
the
Panorama
local
data.
With
the
exception
of
the
data
that
displays
in
the
Application
chart,
all
other
charts
require
you
to
enable
log
forwarding
to
Panorama.
Using
the
local
data
on
Panorama
provides
a
quick
load
time
for
the
charts.
You
can,
however,
change
the
data
source
to
Remote Device Data
.
When
configured
to
use
Remote
Device
Data,
instead
of
using
the
local
Panorama
data,
Panorama
will
poll
all
the
managed
firewalls
and
present
an
aggregated
view
of
the
data.
The
onscreen
display
indicates
the
total
number
of
firewalls
being
polled
and
the
number
of
firewalls
that
have
responded
to
the
query
for
information.
Select
the
Charts
to
View
—The
ACC
includes
an
array
of
charts
in
the
areas
of
Application,
URL
Filtering,
Threat
Prevention,
Data
Filtering,
and
HIP
Match.
With
the
exception
of
the
Application
charts
and
HIP
Match,
all
the
other
charts
display
only
if
the
corresponding
feature
has
been
licensed
on
the
firewall,
and
you
have
enabled
logging.
Tweak
Time
Frame
and
Sort
Data
—The
reporting
time
period
in
the
ACC
ranges
from
the
last
15
minutes
to
the
last
hour,
day,
week,
month,
or
any
custom
‐
defined
time.
You
can
sort
the
data
by
sessions,
bytes,
or
threats
and
filter
to
view
from
5
‐
500
items.
Analyze
Log
Data
The
Monitor
tab
on
Panorama
provides
access
to
log
data;
these
logs
are
an
archived
list
of
sessions
that
have
been
processed
by
the
managed
firewalls
and
forwarded
to
Panorama.
Log
data
can
be
broadly
grouped
into
two
types:
those
that
detail
information
on
traffic
flows
on
your
network
such
as
applications,
threats,
host
information
profiles,
URL
categories,
content/file
types
and
those
that
record
system
events,
configuration
changes
and
alarms.
Based
on
the
log
forwarding
configuration
on
the
managed
firewalls,
the
Monitor > Logs
tab
can
include
logs
for
traffic
flows,
threats,
URL
filtering,
data
filtering,
Host
Information
Profile
(HIP)
matches,
and
WildFire
submissions.
You
can
review
the
logs
to
verify
a
wealth
of
information
on
a
given
session
or
transaction.
Some
examples
of
this
information
are
the
user
who
initiated
the
session,
the
action
(allow
or
deny)
that
the
firewall
performed
on
the
session,
and
the
source
and
destination
ports,
zones,
and
addresses.
The
system
and
configuration
logs
can
indicate
a
configuration
change
or
an
alarm
that
the
firewall
triggered
when
a
configured
threshold
was
exceeded.
Generate,
Schedule,
and
Reports
Panorama
allows
you
to
generate
reports
manually
as
needed,
or
schedule
reports
to
run
at
specific
intervals.
You
can
save
and
export
reports,
or
you
can
configure
Panorama
to
reports
to
specific
recipients.
The
ability
to
share
reports
using
is
particularly
useful
if
you
want
to
share
reporting
information
with
administrators
who
do
not
have
access
to
Panorama.
You
can
create
the
following
types
of
reports:
It
is
recommended
that
you
install
matching
software
releases
on
Panorama
and
the
firewalls
for
which
you
will
generate
reports.
For
example,
if
the
Panorama
management
server
runs
Panorama
6.1,
install
PAN
‐
OS
6.1
on
its
managed
firewalls
before
generating
the
reports.
This
practice
avoids
issues
that
might
occur
if
you
create
reports
that
include
fields
supported
in
the
Panorama
release
but
not
supported
in
an
earlier
PAN
‐
OS
release
on
the
firewalls.
