The firewall now provides a single Unified log set that enables you to monitor and filter events regardless of log type. The new unified log set includes Traffic, Threat, URL Filtering, WildFire Submissions, and Data Filtering logs in a single view and you can choose to display some or all of these log types.
Additionally, with an active AutoFocus license, you can view AutoFocus threat intelligence for artifacts found in the Unified logs and filter firewall logs based on AutoFocus artifacts.
Unified logs have the same look and feel as other PAN-OS logs but with a few additions.
First Look at Unified Logs
Find unified logs ( ). Select Monitor > Logs > Unified.
( New ) Choose which log types ( ) to display. Select the down arrow to the left of the filter and select one or more of the log types to display: traffic, threat, url, data, and wildfire.
Filter ( ) unified logs. Use the filter to search for specific attributes in log fields. Unified logs include all Traffic, Threat, URL Filtering, WildFire Submissions, and Data Filtering log entries so you can now search for attributes across these log types with a single filter instead of filtering each log type separately.
Export ( ) unified logs. Export the current log set to a comma-separated value (CSV) file.
Adjust the log details ( ) displayed. Hover over any column header to adjust the visible columns. The column options for the Unified log view include all fields that are displayable for Traffic, Threat, URL Filtering, WildFire Submissions, and Data Filtering logs.
( With an AutoFocus License ) Preview AutoFocus threat intelligence ( ) for log entry data. Enable AutoFocus threat intelligence on the firewall. Click an IP address, URL, User-ID, filename, or hash artifact in a log entry to open the AutoFocus Threat Intelligence Summary of the latest findings and risk statistics for that artifact. The AutoFocus threat intelligence summary also allows you to add the artifact from the firewall directly to an AutoFocus search. For details, see View AutoFocus Threat Data for Logs. Explore more ways to use AutoFocus with a Palo Alto Networks firewall.
View additional log entry details ( ). Click the spyglass to display a detailed log view for a single entry. Log entry details vary depending on the type of log you are viewing (Traffic, Threat, URL Filtering, Data Filtering, or WildFire Submissions).

Related Documentation