PAN-OS Query Logs For Indicators

This playbook queries the following PAN-OS log types: traffic, threat, url, data-filtering and wildfire. The playbook accepts inputs such as IP. hash, and url.

Pack

PAN-OS

Tasks

18

Inputs

• url — URL, for example: "safebrowsing.googleapis.com".
• filedigest — File hash (for WildFire logs only).
• ip — Source or destination address

Outputs

• Panorama.Monitor — Monitor logs object.
• Panorama.Monitor.Logs.Action — Action taken for the session. Can be "alert", "allow", "deny", "drop", "drop-all-packets", "reset-client", "reset-server", "reset-both", or "block-url".
• Panorama.Monitor.Logs.Application — Application associated with the session.
• Panorama.Monitor.Logs.Category — For URL subtype, it is the URL category; For WildFire subtype, it is the verdict on the file and is either ‘malicious’, ‘phishing’, ‘grayware’, or ‘benign’; For other subtypes, the value is ‘any’.
• Panorama.Monitor.Logs.DeviceName — The hostname of the firewall on which the session was logged.
• Panorama.Monitor.Logs.DestinationAddress — Original session destination IP address.
• Panorama.Monitor.Logs.DestinationUser — Username of the user to which the session was destined.
• Panorama.Monitor.Logs.DestinationCountry — Destination country or internal region for private addresses. Maximum length is 32 bytes.
• Panorama.Monitor.Logs.DestinationPort — Destination port utilized by the session.
• Panorama.Monitor.Logs.FileDigest — Only for WildFire subtype; all other types do not use this field. The filedigest string shows the binary hash of the file sent to be analyzed by the WildFire service.
• Panorama.Monitor.Logs.FileName — File name or file type when the subtype is file. File name when the subtype is virus. File name when the subtype is wildfire-virus. File name when the subtype is wildfire.
• Panorama.Monitor.Logs.FileType — Only for the WildFire subtype; all other types do not use this field. Specifies the type of file that the firewall forwarded for WildFire analysis.
• Panorama.Monitor.Logs.FromZone — Zone the session was sourced from.
• Panorama.Monitor.Logs.URLOrFilename — The actual URI when the subtype is url. File name or file type when the subtype is file. File name when the subtype is virus. File name when the subtype is wildfire-virus. File name when the subtype is wildfire. URL or file name when the subtype is vulnerability if applicable.
• Panorama.Monitor.Logs.NATDestinationIP — If destination NAT performed, the post-NAT destination IP address.
• Panorama.Monitor.Logs.NATDestinationPort — Post-NAT destination port.
• Panorama.Monitor.Logs.NATSourceIP — If source NAT performed, the post-NAT source IP address.
• Panorama.Monitor.Logs.NATSourcePort — Post-NAT source port.
• Panorama.Monitor.Logs.PCAPid — The packet capture (pcap) ID is a 64 bit unsigned integral denoting an ID to correlate threat pcap files with extended pcaps taken as a part of that flow. All threat logs will contain either a pcap_id of 0 (no associated pcap), or an ID referencing the extended pcap file.
• Panorama.Monitor.Logs.IPProtocol — IP protocol associated with the session.
• Panorama.Monitor.Logs.Recipient — Only for the WildFire subtype; all other types do not use this field. Specifies the name of the receiver of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
• Panorama.Monitor.Logs.Rule — Name of the rule that the session matched.
• Panorama.Monitor.Logs.RuleID — ID of the rule that the session matched.
• Panorama.Monitor.Logs.ReceiveTime — Time the log was received at the management plane.
• Panorama.Monitor.Logs.Sender — Only for the WildFire subtype; all other types do not use this field. Specifies the name of the sender of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
• Panorama.Monitor.Logs.SessionID — An internal numerical identifier applied to each session.
• Panorama.Monitor.Logs.DeviceSN — The serial number of the firewall on which the session was logged.
• Panorama.Monitor.Logs.Severity — Severity associated with the threat. Can be "informational", "low", "medium", "high", or "critical".
• Panorama.Monitor.Logs.SourceAddress — Original session source IP address.
• Panorama.Monitor.Logs.SourceCountry — Source country or internal region for private addresses. Maximum length is 32 bytes.
• Panorama.Monitor.Logs.SourceUser — Username of the user who initiated the session.
• Panorama.Monitor.Logs.SourcePort — Source port utilized by the session.
• Panorama.Monitor.Logs.Name — Palo Alto Networks identifier for the threat. It is a description string followed by a 64-bit numerical identifier.
• Panorama.Monitor.Logs.ID — Palo Alto Networks ID for the threat.
• Panorama.Monitor.Logs.ToZone — The zone to which the session was destined.
• Panorama.Monitor.Logs.TimeGenerated — Time that the log was generated on the dataplane.
• Panorama.Monitor.Logs.URLCategoryList — A list of the URL filtering categories that the firewall used to enforce policy.
• Panorama.Monitor.JobID — Job ID of the logs query.
• Panorama.Monitor.Status — Status of the logs query.
• Panorama.Monitor.Message — Message of the logs query.

Commands used

• pan-os-query-logs