Focus
Focus
Table of Contents

Data Collection

Palo Alto Networks next-generation firewalls collect telemetry data that can be shared with Palo Alto Networks cloud.
If device telemetry is configured, and if the device administrator permits it, a Panorama or next-generation firewall will collect and share data with Palo Alto Networks. The Palo Alto Networks device collects this data by running command line interface (CLI) commands and by accessing internal data sources (such as internal log files) that are sometimes, but not always, viewable by device administrators. The device sends this information to Palo Alto Networks Cortex Data Lake as an unstructured bundle of data on specific time intervals. Data bundles contain the raw output from CLI commands, and entire log files.
When Cortex Data Lake receives this data, it parses the data into tables of information that are needed by telemetry powered applications to perform their function(s).
Telemetry powered applications occasionally use the term 'metrics' to identify the data on which they operate. The metrics that these applications refer to is the information that is created after Cortex Data Lake has parsed and stored the raw data that this document calls "metrics". Be aware that if an application is referring to 'metrics', it is really referring to a subset of the data that device telemetry sends to Cortex Data Lake.
This document identifies the raw data that Palo Alto Networks devices send to Cortex Data Lake. The nature of this data, its collection interval, and most importantly the privacy level for each metric is identified by this document's reference pages.

Data Collected by Palo Alto Networks for Internal Research Purposes

If Product Usage is selected under the telemetry settings, Palo Alto Networks collects data based on user events, such as clicks and device state, to gain insights that help improve future user experience.
Review the PAN-OS Privacy data sheet for more information about our privacy policies.