Panorama Query Logs

Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.

Pack

PAN-OS

Tasks

4

Inputs

• log_type — Log type to query. Can be: traffic, threat, wildfire, url or data-filtering.
• query — The query string by which to match criteria for the logs. This is similar to the query provided in the web interface under the Monitor tab when viewing the logs.
• time-generated — The time the log was generated from the timestamp and prior to it. For example: "2019/08/11 01:10:44".
• addr-src — Source address.
• addr-dst — Destination address.
• ip — Source or destination IP address.
• zone-src — Source zone.
• zone-dst — Destination zone.
• action — Rule action.
• port-dst — Destination port.
• rule — Rule name, for example: "Allow all outbound".
• url — URL, for example: "safebrowsing.googleapis.com".
• filedigest — File hash (for WildFIre logs only).

Outputs

• Panorama.Monitor — Monitor logs object.
• Panorama.Monitor.Logs.Action — Action taken for the session. Can be "alert", "allow", "deny", "drop", "drop-all-packets", "reset-client", "reset-server", "reset-both", or "block-url".
• Panorama.Monitor.Logs.Application — Application associated with the session.
• Panorama.Monitor.Logs.Category — For URL subtype, it is the URL category; For WildFire subtype, it is the verdict on the file and is either ‘malicious’, ‘phishing’, ‘grayware’, or ‘benign’; For other subtypes, the value is ‘any’.
• Panorama.Monitor.Logs.DeviceName — The hostname of the firewall on which the session was logged.
• Panorama.Monitor.Logs.DestinationAddress — Original session destination IP address.
• Panorama.Monitor.Logs.DestinationUser — Username of the user to which the session was sent.
• Panorama.Monitor.Logs.DestinationCountry — Destination country or internal region for private addresses. Maximum length is 32 bytes.
• Panorama.Monitor.Logs.DestinationPort — Destination port utilized by the session.
• Panorama.Monitor.Logs.FileDigest — Only for WildFire subtype; all other types do not use this field. The filedigest string shows the binary hash of the file sent to be analyzed by the WildFire service.
• Panorama.Monitor.Logs.FileName — File name or file type when the subtype is file. File name when the subtype is virus. File name when the subtype is wildfire-virus. File name when the subtype is wildfire.
• Panorama.Monitor.Logs.FileType — Specifies the type of file that the firewall forwarded for WildFire analysis. Relevant only for the WildFire subtype; all other types do not use this field.
• Panorama.Monitor.Logs.FromZone — Zone from which the session originated.
• Panorama.Monitor.Logs.URLOrFilename — The actual URI when the subtype is url. File name or file type when the subtype is file. File name when the subtype is virus. File name when the subtype is wildfire-virus. File name when the subtype is wildfire. URL or file name when the subtype is vulnerability if applicable.
• Panorama.Monitor.Logs.NATDestinationIP — If destination NAT performed, the post-NAT destination IP address.
• Panorama.Monitor.Logs.NATDestinationPort — Post-NAT destination port.
• Panorama.Monitor.Logs.NATSourceIP — If source NAT performed, the post-NAT source IP address.
• Panorama.Monitor.Logs.NATSourcePort — Post-NAT source port.
• Panorama.Monitor.Logs.PCAPid — The packet capture (pcap) ID is a 64 bit unsigned integral denoting an ID to correlate threat pcap files with extended pcaps taken as a part of that flow. All threat logs contain either a pcap_id of 0 (no associated pcap), or an ID referencing the extended pcap file.
• Panorama.Monitor.Logs.IPProtocol — IP protocol associated with the session.
• Panorama.Monitor.Logs.Recipient — Specifies the name of the receiver of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall. Valid only for the WildFire subtype; all other types do not use this field.
• Panorama.Monitor.Logs.Rule — Name of the rule that the session matched.
• Panorama.Monitor.Logs.RuleID — ID of the rule that the session matched.
• Panorama.Monitor.Logs.ReceiveTime — Time the log was received at the management plane.
• Panorama.Monitor.Logs.Sender — Specifies the name of the sender of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall. Valid only for the WildFire subtype; all other types do not use this field.
• Panorama.Monitor.Logs.SessionID — An internal numerical identifier applied to each session.
• Panorama.Monitor.Logs.DeviceSN — The serial number of the firewall on which the session was logged.
• Panorama.Monitor.Logs.Severity — Severity associated with the threat. Can be "informational", "low", "medium", "high", or "critical".
• Panorama.Monitor.Logs.SourceAddress — Original session source IP address.
• Panorama.Monitor.Logs.SourceCountry — Source country or internal region for private addresses. Maximum length is 32 bytes.
• Panorama.Monitor.Logs.SourceUser — Username of the user who initiated the session.
• Panorama.Monitor.Logs.SourcePort — Source port utilized by the session.
• Panorama.Monitor.Logs.Name — Palo Alto Networks identifier for the threat. It is a description string followed by a 64-bit numerical identifier.
• Panorama.Monitor.Logs.ID — Palo Alto Networks ID for the threat.
• Panorama.Monitor.Logs.ToZone — The zone to which the session was sent.
• Panorama.Monitor.Logs.TimeGenerated — Time that the log was generated on the dataplane.
• Panorama.Monitor.Logs.URLCategoryList — A list of the URL filtering categories that the firewall used to enforce policy.
• Panorama.Monitor.Logs.Vsys — Vsys on the firewall that generated the log.
• Panorama.Monitor.JobID — Job ID of the log query.
• Panorama.Monitor.Status — Status of the log query.
• Panorama.Monitor.Message — Message of the log query.

Commands used

• pan-os-query-logs