Palo Alto Networks, Inc.
Using log event messages to identify a user and enforce policies

Abstract:

Enforcing a policy is described. System log messages are received, via an interface, from a network device. At least a portion of the received system log messages are parsed to obtain an IP address and to obtain a user identifier. A policy to apply to a session associated with the IP address is determined, based at least in part on the user identifier. The policy is applied to the session.