Threat Log Fields

Format
: FUTURE_USE, Receive Time, Serial Number, Type, Threat/Content Type, FUTURE_USE, Generated Time, Source IP, Destination IP, NAT Source IP, NAT Destination IP, Rule Name, Source User, Destination User, Application, Virtual System, Source Zone, Destination Zone, Inbound Interface, Outbound Interface, Log Action, FUTURE_USE, Session ID, Repeat Count, Source Port, Destination Port, NAT Source Port, NAT Destination Port, Flags, Protocol, Action, URL/Filename, Threat ID, Category, Severity, Direction, Sequence Number, Action Flags, Source Location, Destination Location, FUTURE_USE, Content Type, PCAP_ID, File Digest, Cloud, URL Index, User Agent, File Type, X-Forwarded-For, Referer, Sender, Subject, Recipient, Report ID, Device Group Hierarchy Level 1, Device Group Hierarchy Level 2, Device Group Hierarchy Level 3, Device Group Hierarchy Level 4, Virtual System Name, Device Name, FUTURE_USE, Source VM UUID, Destination VM UUID, HTTP Method, Tunnel ID/IMSI, Monitor Tag/IMEI, Parent Session ID, Parent Start Time, Tunnel Type, Threat Category, Content Version, FUTURE_USE
Field Name
Description
Receive Time
Time the log was received at the management plane.
Serial Number (serial #)
Serial number of the firewall that generated the log.
Type
Specifies type of log; values are traffic, threat, config, system and hip-match.
Threat/Content Type
Subtype of threat log. Values include the following:
  • data—Data pattern matching a Data Filtering profile.
  • file—File type matching a File Blocking profile.
  • flood—Flood detected via a Zone Protection profile.
  • packet—Packet-based attack protection triggered by a Zone Protection profile.
  • scan—Scan detected via a Zone Protection profile.
  • spyware —Spyware detected via an Anti-Spyware profile.
  • url—URL filtering log.
  • virus—Virus detected via an Antivirus profile.
  • vulnerability —Vulnerability exploit detected via a Vulnerability Protection profile.
  • wildfire —A WildFire verdict generated when the firewall submits a file to WildFire per a WildFire Analysis profile and a verdict (malicious, phishing, grayware, or benign, depending on what you are logging) is logged in the WildFire Submissions log.
  • wildfire-virus—Virus detected via an Antivirus profile.
Generated Time (Generate Time)
Time the log was generated on the dataplane.
Source Address
Original session source IP address.
Destination Address
Original session destination IP address.
NAT Source IP
If source NAT performed, the post-NAT source IP address.
NAT Destination IP
If destination NAT performed, the post-NAT destination IP address.
Rule Name (rule)
Name of the rule that the session matched.
Source User
Username of the user who initiated the session.
Destination User
Username of the user to which the session was destined.
Application
Application associated with the session.
Virtual System
Virtual System associated with the session.
Source Zone
Zone the session was sourced from.
Destination Zone
Zone the session was destined to.
Inbound Interface
Interface that the session was sourced from.
Outbound Interface
Interface that the session was destined to.
Log Action
Log Forwarding Profile that was applied to the session.
Session ID
An internal numerical identifier applied to each session.
Repeat Count
Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen within 5 seconds; used for ICMP only.
Source Port
Source port utilized by the session.
Destination Port
Destination port utilized by the session.
NAT Source Port
Post-NAT source port.
NAT Destination Port
Post-NAT destination port.
Flags
32-bit field that provides details on session; this field can be decoded by AND-ing the values with the logged value:
  • 0x80000000 —session has a packet capture (PCAP)
  • 0x02000000 —IPv6 session
  • 0x01000000 —SSL session was decrypted (SSL Proxy)
  • 0x00800000 —session was denied via URL filtering
  • 0x00400000 —session has a NAT translation performed (NAT)
  • 0x00200000 —user information for the session was captured through Captive Portal
  • 0x00080000 —X-Forwarded-For value from a proxy is in the source user field
  • 0x00040000 —log corresponds to a transaction within a http proxy session (Proxy Transaction)
  • 0x00008000 —session is a container page access (Container Page)
  • 0x00002000 —session has a temporary match on a rule for implicit application dependency handling. Available in PAN-OS 5.0.0 and above
  • 0x00000800 —symmetric return was used to forward traffic for this session
IP Protocol
IP protocol associated with the session.
Action
Action taken for the session; values are alert, allow, deny, drop, drop-all-packets, reset-client, reset-server, reset-both, block-url.
  • alert—threat or URL detected but not blocked
  • allow— flood detection alert
  • deny—flood detection mechanism activated and deny traffic based on configuration
  • drop— threat detected and associated session was dropped
  • reset-client —threat detected and a TCP RST is sent to the client
  • reset-server —threat detected and a TCP RST is sent to the server
  • reset-both —threat detected and a TCP RST is sent to both the client and the server
  • block-url —URL request was blocked because it matched a URL category that was set to be blocked
  • block-ip—threat detected and client IP is blocked
  • random-drop—flood detected and packet was randomly dropped
  • sinkhole—DNS sinkhole activated
  • syncookie-sent—syncookie alert
  • block-continue (URL subtype only)—a HTTP request is blocked and redirected to a Continue page with a button for confirmation to proceed
  • continue (URL subtype only)—response to a block-continue URL continue page indicating a block-continue request was allowed to proceed
  • block-override (URL subtype only)—a HTTP request is blocked and redirected to an Admin override page that requires a pass code from the firewall administrator to continue
  • override-lockout (URL subtype only)—too many failed admin override pass code attempts from the source IP. IP is now blocked from the block-override redirect page
  • override (URL subtype only)—response to a block-override page where a correct pass code is provided and the request is allowed
  • block (Wildfire only)—file was blocked by the firewall and uploaded to Wildfire
URL/Filename
Field with variable length. A Filename has a maximum of 63 characters. A URL has a maximum of 1023 characters
The actual URI when the subtype is url
File name or file type when the subtype is file
File name when the subtype is virus
File name when the subtype is wildfire-virus
File name when the subtype is wildfire
URL or File name when the subtype is vulnerability if applicable
Threat Content Name
Palo Alto Networks identifier for the threat. It is a description string followed by a 64-bit numerical identifier in parentheses for some Subtypes:
  • 8000 – 8099— scan detection
  • 8500 – 8599— flood detection
  • 9999— URL filtering log
  • 10000 – 19999 —spyware phone home detection
  • 20000 – 29999 —spyware download detection
  • 30000 – 44999 —vulnerability exploit detection
  • 52000 – 52999— filetype detection
  • 60000 – 69999 —data filtering detection
Threat ID ranges for virus detection, WildFire signature feed, and DNS C2 signatures used in previous releases have been replaced with permanent, globally unique IDs. Refer to the Threat/Content Type and Threat Category (thr_category) field names to create updated reports, filter threat logs, and ACC activity.
Category
For URL Subtype, it is the URL Category; For WildFire subtype, it is the verdict on the file and is either ‘malicious’, ‘phishing’, ‘grayware’, or ‘benign’; For other subtypes, the value is ‘any’.
Severity
Severity associated with the threat; values are informational, low, medium, high, critical.
Direction
Indicates the direction of the attack, client-to-server or server-to-client:
  • 0—direction of the threat is client to server
  • 1—direction of the threat is server to client
Sequence Number
A 64-bit log entry identifier incremented sequentially. Each log type has a unique number space.
Action Flags
A bit field indicating if the log was forwarded to Panorama.
Source Country
Source country or Internal region for private addresses. Maximum length is 32 bytes.
Destination Country
Destination country or Internal region for private addresses. Maximum length is 32 bytes.
Content Type (contenttype)
Applicable only when Subtype is URL.
Content type of the HTTP response data. Maximum length 32 bytes.
PCAP ID (pcap_id)
The packet capture (pcap) ID is a 64 bit unsigned integral denoting an ID to correlate threat pcap files with extended pcaps taken as a part of that flow. All threat logs will contain either a pcap_id of 0 (no associated pcap), or an ID referencing the extended pcap file.
File Digest (filedigest)
Only for WildFire subtype; all other types do not use this field
The filedigest string shows the binary hash of the file sent to be analyzed by the WildFire service.
Cloud (cloud)
Only for WildFire subtype; all other types do not use this field.
The cloud string displays the FQDN of either the WildFire appliance (private) or the WildFire cloud (public) from where the file was uploaded for analysis.
URL Index (url_idx)
Used in URL Filtering and WildFire subtypes.
When an application uses TCP keepalives to keep a connection open for a length of time, all the log entries for that session have a single session ID. In such cases, when you have a single threat log (and session ID) that includes multiple URL entries, the url_idx is a counter that allows you to correlate the order of each log entry within the single session.
For example, to learn the URL of a file that the firewall forwarded to WildFire for analysis, locate the session ID and the url_idx from the WildFire Submissions log and search for the same session ID and url_idx in your URL filtering logs. The log entry that matches the session ID and url_idx will contain the URL of the file that was forwarded to WildFire.
User Agent (user_agent)
Only for the URL Filtering subtype; all other types do not use this field.
The User Agent field specifies the web browser that the user used to access the URL, for example Internet Explorer. This information is sent in the HTTP request to the server.
File Type (filetype)
Only for WildFire subtype; all other types do not use this field.
Specifies the type of file that the firewall forwarded for WildFire analysis.
X-Forwarded-For (xff)
Only for the URL Filtering subtype; all other types do not use this field.
The X-Forwarded-For field in the HTTP header contains the IP address of the user who requested the web page. It allows you to identify the IP address of the user, which is useful particularly if you have a proxy server on your network that replaces the user IP address with its own address in the source IP address field of the packet header.
Referer (referer)
Only for the URL Filtering subtype; all other types do not use this field.
The Referer field in the HTTP header contains the URL of the web page that linked the user to another web page; it is the source that redirected (referred) the user to the web page that is being requested.
Sender (sender)
Only for WildFire subtype; all other types do not use this field.
Specifies the name of the sender of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
Subject (subject)
Only for WildFire subtype; all other types do not use this field.
Specifies the subject of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
Recipient (recipient)
Only for WildFire subtype; all other types do not use this field.
Specifies the name of the receiver of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
Report ID (reportid)
Only for WildFire subtype; all other types do not use this field.
Identifies the analysis request on the WildFire cloud or the WildFire appliance.
Device Group Hierarchy (dg_hier_level_1 to dg_hier_level_4)
A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. The firewall (or virtual system) generating the log includes the identification number of each ancestor in its device group hierarchy. The shared device group (level 0) is not included in this structure.
If the log values are 12, 34, 45, 0, it means that the log was generated by a firewall (or virtual system) that belongs to device group 45, and its ancestors are 34, and 12. To view the device group names that correspond to the value 12, 34 or 45, use one of the following methods:
CLI command in configure mode:
show readonly dg-meta-data
API query:
/api/?type=op&cmd=<show><dg-hierarchy></dg-hierarchy></show>
Virtual System Name (vsys_name)
The name of the virtual system associated with the session; only valid on firewalls enabled for multiple virtual systems.
Device Name (device_name)
The hostname of the firewall on which the session was logged.
Source VM UUID
Identifies the source universal unique identifier for a guest virtual machine in the VMware NSX environment.
Destination VM UUID
Identifies the destination universal unique identifier for a guest virtual machine in the VMware NSX environment.
HTTP Method
Only in URL filtering logs. Describes the HTTP Method used in the web request. Only the following methods are logged: Connect, Delete, Get, Head, Options, Post, Put.
Tunnel ID/IMSI
International Mobile Subscriber Identity (IMSI) is a unique number allocated to each mobile subscriber in the GSM/UMTS/EPS system. IMSI shall consist of decimal digits (0 through 9) only and maximum number of digits allowed are 15.
Monitor Tag/IMEI
International Mobile Equipment Identity (IMEI) is a unique 15 or 16 digit number allocated to each mobile station equipment.
Parent Session ID
ID of the session in which this session is tunneled. Applies to inner tunnel (if two levels of tunneling) or inside content (if one level of tunneling) only.
Parent Start Time (parent_start_time)
Year/month/day hours:minutes:seconds that the parent tunnel session began.
Tunnel Type (Tunnel)
Type of tunnel, such as GRE or IPSec.
Threat Category (thr_category)
Describes threat categories used to classify different types of threat signatures.
Content Version (contentver)
Applications and Threats version on your firewall when the log was generated.

Related Documentation