Reporter for Palo Alto Release Notes

Reporter for PaloAlto 1.0.1.46 (2021-02-16)

Improved log import speed.
The Blocked Unacceptable Sites widget no longer shows IPs from application traffic.
Updated text in Settings | Licensing to remove the message about the number of license keys relating to licensed sources. A single key can now license multiple sources.
Updated default keywords relating to Adult and Profanity alerts and suspicious searches. Note: You will not see the changes to Alerts automatically. Please see our article on Updating Alerts to the latest version while keeping any custom alerts.

Reporter for Palo Alto 1.0.1.45 (2020-11-17)

First GA Release of Fastvue Reporter for Palo Alto!
Improved licensing system. Each installation of Fastvue Reporter can now support a single key in Settings | Licensing that can be renewed rather than replaced at renewal time with a new key. Fastvue Reporter also no longer requires a separate key for each firewall that needs monitoring.
Added a Proxy Settings page to enter the details of your proxy server if one is required for Fastvue Reporter to connect to the internet. The Fastvue Reporter server needs to access licensing.fastvue.co and api.fastvue.co for license activation and Site Clean updates.
Size is now shown for web data (URLs) when running in Demo Mode.

Reporter for Palo Alto 1.0.0.13 BETA (2020-10-26)

Fixed issue introduced in 1.0.0.12 that can increase RAM usage, make the software unresponsive, and prevent the import of data.
Reports and Alerts can now be filtered by Virtual System.
Fixed issue preventing the export of reports with long titles.
Reports are now automatically unloaded from memory after 15 minutes of inactivity.
Fixed issue preventing the import of Security Groups with more than 1500 members.
Improved search results extracted from Yahoo, Bing and YouTube.
Authenticated traffic is now correctly matched to an Active Directory user object when the firewall logs the UserPrincipalName as the user.
Fixed issue where filtering Activity Reports by Productivity groups provided unexpected results in some cases.

Reporter for Palo Alto 1.0.0.12 BETA (2020-09-22)

All reports have been adjusted to show the bandwidth information for Sites. Fastvue Reporter is now calculating the size of URLs in the Threat log using the matching session ID in the Traffic log.
- Added Top Sites and Top Downloads widgets to the Bandwidth Dashboard.
- Renamed the Usage section to Bandwidth in the Internet Usage and All Usage reports. Added Top Sites by Size widget, and added size columns to other widgets in the report.
- Activity Reports now show a ‘Size’ column.
- The Allowed Sites section in the IT Network and Security and All Usage report now includes size columns.
The filter in for the Allowed Sites section in the IT Network and Security Report was adjusted as it was also showing blocked sites.
The duplicated Most Allowed Undesirable Application widget in the IT Overview section of the IT Network and Security and All Usage Reports was replaced with Top Rule.
Fixed inconsistencies in column naming in the IT Network and Security report

Reporter for Palo Alto 1.0.0.11 BETA (2020-09-02)

Size of URLs in the Threat log are now calculated by matching the session ID in the Traffic log. For sessions with more than one URL in the Threat log, the size is attributed to the last URL in the session.
The ‘Any’ category is no longer attributed to a Productivity list. This was causing a large amount of traffic to show under the ‘Unassigned’ Productivity group.
Renamed the Firewall Server field to Firewall Hostname
Added Firewall IP field
Fixed issue with excessive memory and CPU usage when an alert is configured using the ‘Greater than’, ‘Less than’, ‘Greater than or equal’, or ‘Less than or equal’ operators on numeric fields that are not aggregates, such as Hours or Ports.

Reporter for Palo Alto 1.0.0.10 BETA (2020-08-07)

Fixed a range of log parsing issues. You may have seen strange ‘Threat Detected’ alerts and/or URLs appearing in the Unassigned list in Settings | Productivity.
Fixed issue where most Categories were not correctly falling into a Productivity list, resulting in most traffic showing as ‘Unassigned’ or ‘Uncertain’ in the Dashboards and Reports.
Updated Productivity settings to adjust for changes in Palo Alto v10. To get the latest changes, you will need to manually reset your Productivity settings after upgrading the software. To do this, please see our article on resetting Productivity settings to defaults.
Alerts on web traffic that show URLs no longer include application traffic with blank URLs. After upgrading, you will need to manually upgrade your alerts. To do this, please see our article on updating alerts to the latest version.
The Categories widget in the User All Usage report no longer reports 0 size for each Category.
The ‘Any’ Category is now excluded from the Categories widgets in Dashboards and Reports (Palo Alto logs ‘Any’ as the category for Application traffic that does not make it into the Content Filter).
Fixed issue where the ‘Top User’ and ‘Top Site’ widgets in Overview Reports were not correct.
Fixed issue where the Warned Sites widget in the IT Network and Security report was showing Allowed sites.
Fixed link to the Getting Started Guide in the installation launcher app.
Filtering reports by Filename Extension no longer requires the extension to be entered in UPPERCASE.
Fixed an issue where strange Search Terms such as “56,148,835,15” were being extracted from YouTube.
Fixed issue preventing picklists from being presented when filtering by certain fields such as Event/Message Types.

Reporter for Palo Alto 1.0.0.9 BETA (2020-06-25)

Reports can now be filtered by ‘Manager’. For example, select Manager ‘Equal to’ Bob to filter a report by all of Bob’s employees/subordinates as defined in Active Directory. You can of course schedule this report to send to Bob every day, week or month.

Reporter for Palo Alto 1.0.0.8 BETA (2020-06-10)

Changes to default Alerts:
- Added a new Drug Searches Alert
- Increased the Unproductive Browsing > 30 Minutes alert to Unproductive Browsing > 1 hour.
- Renamed the High Risk Detected alert to High Risk Sites and added a filter for Event Type = Url.
- Renamed Threat Detected Alert to Threat Detected (High or Critical) and added filters for High or Critical severity.
- Added Threat Detected (Medium or Low) – a low priority alert filtering threats by Medium and Low severities.
- Renamed the Wildfire Inspection Result Detected alert to Wildfire Inspection Result and changed its priority to Medium.
- Renamed Bandwidth Alert > 1 hour alert to Bandwidth Over 20 GB in 4 Hours and changed the criteria appropriately.

Changes to IT Network and Security and All Usage Reports:
- Moved Firewall Actions Over Time from the Overview Section to the Firewall section.
- Added Palo Alto Firewalls widget to the Firewall section.
- Removed Application widget from the Firewall section.
- Added filter to remove blank categories from the Allowed Web Categories widget.
- The Threats section now includes widgets for High/Critical Threats and Medium/Low Threats.

Modified the layout of the Start page.
Fixed issue related to the parsing of log lines with multiple URL Categories.
The Block Evidence field now contains a comma-separated list of multiple categories when applicable.

Reporter for Palo Alto 1.0.0.7 BETA (2020-05-12)

Fixed issue where the Schedule Report button would not work (issue was introduced in build (1.0.0.4)
Fixed issue where links to Private Reports would no longer work once the Fastvue Reporter service is restarted.
Fixed URL parsing issue where URLs shorter than 15 characters with no scheme (e.g. http or https) appeared as an invalid URL.
Viewers of Private Reports can now export the report to PDF or CSV.

Reporter for Palo Alto 1.0.0.6 BETA (2020-04-23)

Fixed issue where launching reports from an existing report (via hover-over) includes an extra date in the date range, and shows an incorrect date range in the report title.