10.3 Application Command Center (ACC), Dashboards, and Custom Reporting

10.3 Application Command Center (ACC), Dashboards, and Custom Reporting

Task 3.5 of the NGFW Engineer blueprint requires engineers to build Application Command Center (ACC) dashboards and custom reports. Although this sits in the Integration and Automation domain, the ACC and reporting are operational monitoring features of the firewall itself, used to answer the question "what is happening on this firewall right now and over the reporting period?"

---

The Application Command Center (ACC)

The Application Command Center (ACC) is the firewall's main monitoring page. It summarizes firewall activity over a selectable time range (the last hour, day, week, or a custom window) and breaks it down into widgets that an engineer can drill into.

Core ACC Filters

• Time range: the period summarized by every widget on the page.
• VSYS / device: scope the view to one virtual system.
• Source / destination: filter to a specific address, user, or region.
• Application: focus the whole page on one App-ID.

Changing a filter reapplies it to every widget, which makes the ACC a fast triage tool: an engineer can scope the page to a single user or application and immediately see every related widget update.

Standard ACC Widgets

Each widget is drill-enabled: clicking a row opens the underlying log viewer filtered to that selection, letting the engineer move from a summary directly to the session-level evidence.

ACC Network and Network Lite Views

For network-centric triage, the ACC offers Network and Network Lite views focused on Layer-3/Layer-4 activity — top sources, destinations, applications by bytes and sessions, and connection states — useful when the investigation is about routing, bandwidth, or connectivity rather than application identity or threat content. Selecting the right ACC view up front avoids wading through application and URL widgets that are irrelevant to a pure network issue, and the Network Lite view loads faster on lower-throughput management sessions where the full ACC is not needed.

---

Custom Dashboards

Beyond the ACC, PAN-OS supports custom dashboards that an administrator composes from widgets. Dashboards let each admin personalize the monitoring view to their role.

• Widget library: traffic widgets, threat widgets, custom log-based widgets, and application-specific widgets can be added.
• Per-administrator: a dashboard belongs to the administrator who builds it, so a security analyst and a network engineer can maintain different views.
• Refresh intervals: widgets refresh on a configured interval for near-real-time monitoring.

A typical security-operations dashboard combines a top-threats widget, a top-blocked-URL widget, and a custom log widget filtered to high-severity events, giving a watch floor view at a glance.

---

Custom Reports

Custom reports generate structured summaries on a schedule or on demand. They are the primary way to produce recurring deliverables for stakeholders and auditors.

Report Anatomy

A custom report is defined by:

1. A log type and a filter: for example, all threat logs with severity high in the last seven days.
2. Grouping and sorting: group by application, user, or threat name, sorted by session or byte count.
3. A schedule: run hourly, daily, weekly, or monthly; or run on demand.
4. Output and delivery: export to PDF or CSV, and email the result to a distribution list.

Report Groups

Report groups organize related reports so they can be generated together. A report group can be scoped to a VSYS or a Panorama device group, which means a tenant administrator scoped to their VSYS only sees and runs their own reports. This keeps multi-tenant reporting aligned with the VSYS boundary described in section 10.1.

Report Data Sources and Delivery

A custom report can draw from two log sources, and the choice changes what the report can see:

• On-device (local) logs: traffic, threat, URL, and data filtering logs stored on the firewall itself or on a connected Panorama Log Collector. Local retention is bounded by disk, so long-range historical reports depend on what is still on disk.
• Strata Logging Service (formerly Cortex Data Lake): a cloud-delivered log storage service that ingests logs from NGFWs, Cloud NGFW, and Prisma Access. When the firewall forwards logs to Strata Logging Service, reports and ACC queries run against cloud-aggregated data with far longer retention and no local disk pressure; both Panorama and Strata Cloud Manager surface those logs once configured.

Email delivery of a scheduled report requires a configured SMTP server profile on the firewall (or on Panorama). The report definition pairs the schedule with a recipient list and the output format — PDF for human-readable summaries, CSV for ingestion into a SIEM or spreadsheet analysis. Selecting the data source to match the reporting window is part of correct report design, not a separate configuration step.

Predefined Reports

PAN-OS ships a library of predefined reports organized by category (traffic summary, threat summary, URL filtering, system) that cover common operational and compliance questions out of the box. Engineers should check the predefined library before building a custom report — many compliance and executive-summary needs are already met, and predefined reports are maintained across PAN-OS releases. Custom reports are reserved for organization-specific filters, groupings, or combinations the predefined set does not cover, which keeps the custom-report inventory small and meaningful.

---

Common Reporting Use Cases

---

Putting ACC, Dashboards, and Reports Together

The operational workflow ties the three together:

1. Use the ACC for real-time triage and drill-down into an active situation.
2. Build a custom dashboard for the recurring operational view a role needs every day.
3. Schedule custom reports for the deliverables stakeholders and auditors expect on a fixed cadence.

This division keeps reactive triage (ACC), personal monitoring (dashboards), and formal output (reports) in the right tools, and it is the workflow the blueprint tests under task 3.5.

---

Common Reporting and Monitoring Traps

Three pitfalls recur on the exam and in practice:

1. Time-range versus retention mismatch: a monthly report run against locally stored logs that only retain seven days returns incomplete data with no warning. Match the report schedule to the data-source retention, or forward logs to Strata Logging Service for long-range reporting.
2. Shared-scope reports in multi-tenant VSYS: reports left in the shared scope are visible to every administrator, breaking tenant isolation. Scope report groups to each VSYS or device group so a tenant admin only sees their own data.
3. Confusing dashboards with reports: a custom dashboard is a live, interactive, per-administrator view; a custom report is a static, scheduled, exportable deliverable. Auditors and compliance teams want the latter, and the NGFW Engineer exam tests the distinction explicitly under task 3.5.