View Advanced IP Defense Logs in PAN-OS and Panorama

1. Log in to the PAN-OS web interface.
2. Select MonitorLogsThreat.
3. Filter for Advanced IP Defense log entries.

   Use the following filter expressions to isolate Advanced IP Defense entries:

   • ( subtype eq aipd )
   • ( name-of-threatid eq AdvIPD )

   The log list displays Advanced IP Defense-specific columns including AIPD Category (Attributes), AIPD Profile, AIPD Rule, AIPD Match Field, and AIPD DNS Seen (Direct-to-IP Detection).

4. Click a log entry to view the full details.

   The Detailed Log View shows the following Advanced IP Defense-specific fields under the Details section:

   • Threat Type—aipd
   • Threat ID/Name—AdvIPD
   • Category—aipd-security
   • Severity—The log severity configured in the matched rule
   • AIPD Profile—The profile that triggered the detection
   • AIPD Match Field—Whether the source or destination IP was inspected (src_ip or dst_ip)
   • AIPD Category (Attributes)—The matched categories and their specific attributes, formatted as Category(attribute1,attribute2,...)
   • AIPD Rule—The specific rule within the profile that matched
   • AIPD DNS Seen (Direct-to-IP Detection)—Whether the connection had a prior DNS resolution

5. (Optional) Configure log forwarding to Strata Logging Service.

   To access Advanced IP Defense logs in Strata Cloud Manager and enable Activity Insights visibility, configure log forwarding to send threat logs to Strata Logging Service. Select ObjectsLog Forwarding and create or edit a log forwarding profile to include threat logs.