Revisiting old topic - Custom Alerts for ConfigSources
At this time I have a need for a custom ConfigSource that would compare 2 textual files and report on Any Change. Nothing fancy and the new ConfigSource with defaultsettings indeed works just fine IF you only want to get an alert that a change was detected. However I would like to pass the actual lines that were modified in the alert. In searching for this topic I found anarchived post from 5 years ago. Custom Alerts for ConfigSources In that post Nick is asking if it is possible to do the following; Being able to put what lines were added or removed right in the alert. For simple configs you can then tell right away if you need to take action or not. That’s exactly what I am after. The archived post was posted 5 years ago…. does anybody know if there was any progress on this feature? I have a sinking feeling this is not possible today, or at least it’s not any easier than it was 5 years ago. Back to custom scripting?Solved66Views6likes3CommentsCan LM Config Monitor and Alert on Palo Firewall Rules Changes ?
Hi ! My customer wants to be able to generatea weekly report on any changes made in the rules of their Palo Alto firewalls (hundreds) whether this is done as part of a template push or a one-off. Is this something that LM Config can provide ? Cheers, Scott H66Views2likes1CommentConfigSource to compare to a known template (PoC)
LM Config is awesome - but until now you've not been able to compare a config to a "known good" template. Now you can... Edit for v1.4.0+: Now gives a MUCH cleaner output (in my humble opinion) - see comments below for details.v1.4.0:2GTW7W If you really want the earlier version with its more expansive output,v1.3.0 as detailed in this first post is atXHDDP4 Edit for v1.3.0+: The groovy check that picks up on the change-from-template flags is now more flexible, in that it looks at each line in turn (rather than the entire config object) so you can more carefully identify matches to be alerted on. This is very much only a proof-of-concept, which will show the method to use. As written it will do nothing in your account as it looks for a couple of test files I created specifically for this in my account. Suppose you have this template file (configTestTemplate.txt) for a config: # Config test file:# Here's a config test fileSetting1=1Setting2=2Setting3=3# The above must never be changed Now, suppose the actual config (in configTestConfig.txt)is like this: # Config test file:# Here's a config test fileSetting1=1Setting2=2Setting3=4# The above must never be changed If you can't see it, 'Setting3' has been changed... This ConfigSource will read in both the config (from file in this example, but it could be from SSH, etc) and the template from file, then run through the template and compare each line to the equivalent line in the config. Where it finds a discrepancy between the two, these are listed in the output after the actual config, marked with 'DISCREPANCY', as in the screenshot below. The template used for comparison is also returned: Config Checks then pick up on changes as you'd normally expect, and also if the output contains 'DISCREPANCY'. Notes: You must have LM Config to use this The template file must contain the EXACT same text in the EXACT same format as the config will be produced, because this PoC only checks line 1 against line 1, line 2 against line 2, etc. If your template contains'DISCREPANCY' you'll have to come up with some other keyword to print and alert on, obviously.40Views1like5Comments