Threatening SaaS Traffic
Table of Contents
Expand all | Collapse all
-
- Access.Log
- Advanced L7 Services Shared Memory State
- Advanced Routing BFD Details
- Advanced Routing Resources and Routes
- AIOps Application Logs
- AIOps Node Details
- AIOps Node Endpoints
- AIOps Node Topology
- AIOps VLD Manager Logs
- App Command Center Reports
- App Command Center Reports
- ARP Management Table
- ARP Table
- Audit.Log
- Authentication Daemon (authd) Log
- BFD Session Details
- Cellular Modem Data Session Information
- Chassis Inventory
- Chassis Power Status
- Chassis Ready State
- Chassis Status
- CIE CLI commands
- Cloud Management Connection Status
- Cluster Node Consistency Check
- Content Update Counters
- CPU Load Sampling by Firewall Function
- CPU Utilization Statistics
- Crash and Trace Files
- CTD Configuration State
- Data-Management Plane Health Heartbeat
- Dataplane Packet Diagnostics Settings
- Device Certificate Status
- Device Certificate Status
- Device Logging Health
- Device Logging Preference List
- Device Server FQDN Resolved IPs
- Device Telemetry Curl Logs
- Device Telemetry Send.Log
- Disk Usage and Dangling File Descriptors
- Distributord.Log
- DOS Block Table
- DPDK Packet I/O Settings
- Dscd.Log
- Configuration lock log
- Configuration lock log
- EDL Capacities
- Elasticsearch Aliases
- Elasticsearch Certificates
- Elasticsearch Cluster Pending Tasks
- Elasticsearch Cluster Tasks
- ElasticSearch health
- Elasticsearch Indices
- Elasticsearch Invalid Replicas
- Elasticsearch Nodes
- Elasticsearch Shard Information
- Elasticsearch Unassigned Shards
- Error.Log
- Filemgr connection status
- Firewall pcap enablement status
- Front LED State
- GlobalProtect Client Versions
- GlobalProtect Gateway Statistics
- GlobalProtect hip-profile-database statistics
- GlobalProtect Logs
- GlobalProtect Logs (Extended)
- GlobalProtect Operating System Types
- GlobalProtect Portal Connection Failure
- GlobalProtect Quarantined Devices
- Globalprotect Service Logs
- GlobalProtect Successful Connections
- Gp Broker.Log
- GP Portal Satellite Authentication Status
- HA and Configuration SDB Variables
- HA Health Errors
- HA System State
- Hardware Alarms
- Hardware and Software Pools
- Hardware Ports
- Hardware System Logs
- Hardware System Logs
- High Availability
- High Availability Backup Interfaces
- High Availability Interface 1
- High Availability Interface 2
- High Availability Interface 4 Backup
- Icd.Log
- Indexgen.Log
- Ingress Backlogs
- Install-History
- Installed Plugins and Jobs
- Inter Log Collection Block Statistics
- Inter Log Collector Status
- IoT Troubleshooting Data
- IoT Verdict Statistics
- Iotd.Log
- IP-User Mapping Count
- IPSec Tunnel Flow Details
- IPSec VPN Tunnel Flow Details
- IPSec-VPN Tunnel Flow
- IPv6 Neighbor Table
- L2Ctrld.Log
- L3Svc Ngx Error.Log
- LACP Aggregate Ethernet Statistics
- Last Commit Information
- Lcaas Agent.Log
- Log Collector Hints
- Log Daemon Queue Statistics
- Log Forwarding Generation Rate
- Log Forwarding Statistics
- Log Receiver Hints Statistics
- Log Receiver Queue Statistics
- Log Receiver Raw Log Forwarding Connection Manager
- Log Receiver Statistics
- LogDB Quotas
- Logging Rate
- Logging Statistics
- Logging Status
- MAC Address Table
- Managed Devices
- Management Interface
- Management Server Client Connections
- Management Server Connections
- Management to Data Plane Counters
- Md Out.Log
- Merged-Running-Config.Xml
- MLAV cloud connection status
- Mp-Monitor.Log
- Ms.Log
- NAT Pool Utilization
- netstat
- Nsx Frr Export.Log
- Number of entries in the PBF Return-mac
- Octeon Chip Health
- Operational Command History
- Packet Buffer Protection
- Packet Scheduling Engine Performance
- Packet Scheduling Engine Status
- Pan Cluster Logs
- Pan Dhcpd.Log
- PAN-DDNS Interface Status
- PAN-DNS Cache Usage
- PAN-DNS End-to-End Response Time
- PAN-DNS FQDN Proxy Information
- PAN-OS Configuration Directory Usage
- PAN-OS Counters
- PAN-OS REST API Usage
- Panorama Admin Sessions
- Panorama Connection Information
- Panorama HA Health
- Panorama Log Reception Rate
- Panorama Logging Infra Health
- Plugin Dlp.Log
- Rasmgr.Log
- Reboot.Log
- Registered IP Addresses
- Reportd.Log
- Root Shell Command History
- Route Table Size
- Routing BFD Details
- Routing Resource
- Running-Config.Xml
- Satd.Log
- SD-WAN Details and Statistics
- SD-WAN Path Monitor Health
- SD-WAN Virtual Interface Rules
- Security Policy Usage and Hit Count
- Security Policy Usage and Hit Count
- Session Distribution
- Session Distribution Policy
- Session Meter
- Session Opening State
- Session Table Usage
- SMART Disk Information
- SMART Disk Information
- Software Component Debug Levels
- Software Component Status
- Software Log
- Software Update History
- SSL Decyrption Memory
- SSL Manager System Daemon State
- SSL Protocol Statistics
- Sslmgr.Log
- Sslvpn Access.Log
- Storage Engine Instance (Correlation)
- Storage Engine Instance (Management)
- Syslog System Log
- Syslog-Ng.Log
- System Capacity
- System Disk Details
- System Disk Utilization
- System Information
- System Jobs
- System Master Key Properties
- System Process Information
- System RAID
- System Resource Memory Statistics
- System State
- System statistics
- System Timezone and Configuration State
- System Timezone and Configuration State
- Timezone and Timestamp
- Traffic Blocked as Malware
- Transceiver Details
- Unit 42 Logs and Device Health Performance
- Unit 42 System Logs
- URL Cache Statistics
- URL Cloud Status
- User Group List
- User Group Mapping State
- User-ID Agent information
- User-ID Agent State
- User-ID Agent State
- User-ID Domain Map Information
- User-ID Redistribution Agent information
- User-ID Redistribution Certificate Expiration
- User-ID Server Monitor Statistics
- User-ID Terminal Server Agent information
- Var Pan Bradgent Log
- Virtual Interface Process State
- VLD Ingestion Statistics
- VLD Logs
- VM Interface Statistics
- VPN Flow Dump Logs
- VPN IKE SA Information
- WildFire Statistics and Status
- WildFire Statistics and Status
- XML Configuration Size
- Logs For Bradagent & Dp-Brdagent.Log & Brdagent.Log & Chassis-Brdagent.Log
- Configuration Daemon Log
- Console-Output.Log Chassis
- Console-Output.Log Non-Chassis
- Crash and Trace Files
- Crash and Trace Files
- Crash and Trace Files
- Current Application ID Version
- Data Plane Statistics
- Device Certificate Status
- Devsrv.Log
- Dnsproxy
- Configuration lock log
- Ehmon.Log
- Fips.Log
- Ikemgr-Ng.Log
- Ikemgr.Log
- Log Receiver and RAID Log
- Logs For Bradagent & Dp-Brdagent.Log & Brdagent.Log & Chassis-Brdagent.Log
- Md Detail.Log
- NTP Configuration
- Pan Comm 0.Log Chassis
- Pan Comm 0.Log Non-Chassis
- Pbp Latency.Log
- Php.Debug.Log
- Previous Application ID Version
- Sysdagent.Log
- System Log
- Useridd.Log
-
- ACC and Monitor Query History
- ARP Management Table
- Configuration Log Contents
- CTD Configuration State
- Device Certificate Status
- Device Certificate Status
- Asymmetric Network Traffic
- License Entitlements
- Managed Devices Licenses
- PAN-OS REST API Usage
- Routing Peers
- Rule Tagging
- Session Table Usage
- SSL Decrypt Configuration
- Support Licenses Installed
- System Timezone and Configuration State
- System Timezone and Configuration State
- Threatening SaaS Traffic
- Timezone and Timestamp
- VM Monitoring
- VM Plugin Usage Statistics
- WildFire Virus Threat Logs
-
- Application Statistics
- ARP Management Table
- Attackers
- Attacking Countries
- Brdagent.Log
- Content and Threat Detection State
- Correlated Events
- Correlated Events Details
- Credential Theft
- CTD Configuration State
- Decryption Usage
- Device Certificate Status
- Device Certificate Status
- DNS-Related Threat Logs
- Dynamic DNS
- File Identification
- Malware Sites
- Management Plane Statistics
- Non-Standard Port Usage
- PAN-DNS Threat Logs
- Parked Domains
- Phishing Sites
- Proxy Avoidance and Anonymizers
- Questionable Sites
- Session Table Usage
- System Timezone and Configuration State
- System Timezone and Configuration State
- Threats Permitted
- Timezone and Timestamp
- Top Application Usage
- Top Threat IDs
- Unknown Applications by Destination Address
- Unknown Applications by Destination Ports
- Unknown Sites
- Unknown TCP or UDP Traffic
Threatening SaaS Traffic
Identifies the percentage of SaaS application traffic that the firewall is categorizing as threatening in some way. For example, because the traffic appears to be generated by a virus or spyware.
Metric Details
|
Category
|
Product Usage
|
|
Daily
| |
|
Telemetry Tier
|
Full
|
|
Equivalent CLI Command
|
ROOT: pan_logquery -b -t threat -n 5000 -e last-24-hrs -q '(characteristic-of-app eq is-saas) and ((subtype eq spyware) or (subtype eq virus) or (subtype eq vulnerability) or (subtype eq wildfire-virus))'
|