GlobalProtect User Name

Content Authoring
1

I am trying to capture the GlobalProtect logon user name. I am using the following relevance. The problem is that instead of the @ sign in the name it returns %2540 in the fixlet debugger and %40 in the analysis.

if exists file "C:\Program Files\Palo Alto Networks\GlobalProtect\pan_gp_hrpt.xml"  
then (select "user-name" of it as text) of selects "/hip-report" of xml documents of 
files "C:\Program Files\Palo Alto Networks\GlobalProtect\pan_gp_hrpt.xml" else 
"None"
2

Do you have a sample of the file?

3

Nevermind, that is the way it appears in the file.

4

Ah, ok.
It may be that Global Protect is percent-encodimg their strings, the same way we do in BigFix. 40 is the hexadecimal for the ASCII values of the ‘@’ symbol.

If you want the Analysis to display the ‘@’ symbol for this one, you might try

if exists file "C:\Program Files\Palo Alto Networks\GlobalProtect\pan_gp_hrpt.xml"  
then (percent decode (it as string) of select "user-name" of it as text) of selects "/hip-report" of xml documents of 
files "C:\Program Files\Palo Alto Networks\GlobalProtect\pan_gp_hrpt.xml" else 
"None"

(You’ll need to fix the doublequote chars, I’m typing this on my phone)

5

Thanks Jason for mentioning the decode inspector! I had to change the relevance to the following because the fixlet debugger was returning “The operator percent decode is not defined”.

if exists file "C:\Program Files\Palo Alto Networks\GlobalProtect\pan_gp_hrpt.xml" 
then percent decode ((select "user-name" of it as text) of selects "/hip-report" of 
xml documents of files "C:\Program Files\Palo Alto 
Networks\GlobalProtect\pan_gp_hrpt.xml") else "None"
1 Like
6

Excellent, glad to help!

Is that case ‘as text’ or should that be ‘as string’?

The ‘percent encode’ and ‘percent decode’ inspectors are also good for decoding internet URLs that are percent-encoded, i.e. for REST API queries sent via URL parameters.