diagnose_user_blocks
Diagnose why a user or IP was blocked by building a timeline of blocks across traffic, threat, URL, WildFire, data filtering, decryption, and GlobalProtect logs. Includes reported URL dependencies.
Instructions
[READ-ONLY] START HERE for a ticket. Builds a timeline of everything that blocked a user or source IP across traffic, threat, URL, WildFire, data filtering, decryption and GlobalProtect logs, grouped and explained (which layer blocked, why, what to check next). With reported_url, flags blocks on OTHER domains at the same time (upload/storage/CDN/SSO dependencies of the site).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| user | No | User name, with or without domain (e.g. 'jdoe' or 'corp\\jdoe') | |
| period | No | Relative time window on receive_time (default: last-24-hrs) | |
| src_ip | No | IP address | |
| firewall | No | Panorama entry from firewalls.json. Optional when a single Panorama is configured. | |
| max_groups | No | Default 30 | |
| reported_url | No | Site mentioned in the ticket | |
| incident_time | No | When the issue happened, 'YYYY/MM/DD HH:MM' in Panorama's timezone. Searches +/-30 minutes around it instead of 'period'. |