Panorama Query Logs

id: Panorama Query Logs
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Panorama Query Logs
description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.'
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a0d6fdde-6ca0-4bfb-8fe1-b107ef3e0781
    type: start
    task:
      id: a0d6fdde-6ca0-4bfb-8fe1-b107ef3e0781
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 8cc99b6c-6607-4ad3-8581-5526974c4bef
    type: condition
    task:
      id: 8cc99b6c-6607-4ad3-8581-5526974c4bef
      version: -1
      name: Is Palo Alto Networks PAN-OS enabled?
      description: Checks if there is a valid instance of the Palo Alto Networks PAN-OS integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Panorama
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: e5880426-a2ca-4286-807c-23641388b07e
    type: regular
    task:
      id: e5880426-a2ca-4286-807c-23641388b07e
      version: -1
      name: Panorama Query Logs
      description: Query logs
      script: '|||pan-os-query-logs'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      action:
        complex:
          root: inputs.action
      addr-dst:
        complex:
          root: inputs.addr-dst
      addr-src:
        complex:
          root: inputs.addr-src
      filedigest:
        complex:
          root: inputs.filedigest
      ip:
        complex:
          root: inputs.ip
      log-type:
        complex:
          root: inputs.log_type
      polling:
        simple: "true"
      port-dst:
        complex:
          root: inputs.port-dst
      query:
        complex:
          root: inputs.query
      rule:
        complex:
          root: inputs.rule
      time-generated:
        complex:
          root: inputs.time-generated
      url:
        complex:
          root: inputs.url
      zone-dst:
        complex:
          root: inputs.zone-dst
      zone-src:
        complex:
          root: inputs.zone-src
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 58850584-2a54-4ac5-80ec-268f5ed17c1a
    type: title
    task:
      id: 58850584-2a54-4ac5-80ec-268f5ed17c1a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 560,
        "width": 492.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: log_type
  value: {}
  required: true
  description: 'Log type to query. Can be: traffic, threat, wildfire, url or data-filtering.'
  playbookInputQuery:
- key: query
  value: {}
  required: false
  description: The query string by which to match criteria for the logs. This is similar to the query provided in the web interface under the Monitor tab when viewing the logs.
  playbookInputQuery:
- key: time-generated
  value: {}
  required: false
  description: 'The time the log was generated from the timestamp and prior to it. For example: "2019/08/11 01:10:44".'
  playbookInputQuery:
- key: addr-src
  value: {}
  required: false
  description: Source address.
  playbookInputQuery:
- key: addr-dst
  value: {}
  required: false
  description: Destination address.
  playbookInputQuery:
- key: ip
  value: {}
  required: false
  description: Source or destination IP address.
  playbookInputQuery:
- key: zone-src
  value: {}
  required: false
  description: Source zone.
  playbookInputQuery:
- key: zone-dst
  value: {}
  required: false
  description: Destination zone.
  playbookInputQuery:
- key: action
  value: {}
  required: false
  description: Rule action.
  playbookInputQuery:
- key: port-dst
  value: {}
  required: false
  description: Destination port.
  playbookInputQuery:
- key: rule
  value: {}
  required: false
  description: 'Rule name, for example: "Allow all outbound".'
  playbookInputQuery:
- key: url
  value: {}
  required: false
  description: 'URL, for example: "safebrowsing.googleapis.com".'
  playbookInputQuery:
- key: filedigest
  value: {}
  required: false
  description: File hash (for WildFIre logs only).
  playbookInputQuery:
outputs:
- contextPath: Panorama.Monitor
  description: Monitor logs object.
  type: string
- contextPath: Panorama.Monitor.Logs.Action
  description: Action taken for the session. Can be "alert", "allow", "deny", "drop", "drop-all-packets", "reset-client", "reset-server", "reset-both", or "block-url".
  type: string
- contextPath: Panorama.Monitor.Logs.Application
  description: Application associated with the session.
  type: string
- contextPath: Panorama.Monitor.Logs.Category
  description: For URL subtype, it is the URL category; For WildFire subtype, it is the verdict on the file and is either ‘malicious’, ‘phishing’, ‘grayware’, or ‘benign’; For other subtypes, the value is ‘any’.
  type: string
- contextPath: Panorama.Monitor.Logs.DeviceName
  description: The hostname of the firewall on which the session was logged.
  type: string
- contextPath: Panorama.Monitor.Logs.DestinationAddress
  description: Original session destination IP address.
  type: string
- contextPath: Panorama.Monitor.Logs.DestinationUser
  description: Username of the user to which the session was sent.
  type: string
- contextPath: Panorama.Monitor.Logs.DestinationCountry
  description: Destination country or internal region for private addresses. Maximum length is 32 bytes.
  type: string
- contextPath: Panorama.Monitor.Logs.DestinationPort
  description: Destination port utilized by the session.
  type: string
- contextPath: Panorama.Monitor.Logs.FileDigest
  description: |-
    Only for WildFire subtype; all other types do not use this field.
    The filedigest string shows the binary hash of the file sent to be analyzed by the WildFire service.
  type: string
- contextPath: Panorama.Monitor.Logs.FileName
  description: |-
    File name or file type when the subtype is file.
    File name when the subtype is virus.
    File name when the subtype is wildfire-virus.
    File name when the subtype is wildfire.
  type: string
- contextPath: Panorama.Monitor.Logs.FileType
  description: |-
    Specifies the type of file that the firewall forwarded for WildFire analysis.
    Relevant only for the WildFire subtype; all other types do not use this field.
  type: string
- contextPath: Panorama.Monitor.Logs.FromZone
  description: Zone from which the session originated.
  type: string
- contextPath: Panorama.Monitor.Logs.URLOrFilename
  description: |-
    The actual URI when the subtype is url.
    File name or file type when the subtype is file.
    File name when the subtype is virus.
    File name when the subtype is wildfire-virus.
    File name when the subtype is wildfire.
    URL or file name when the subtype is vulnerability if applicable.
  type: string
- contextPath: Panorama.Monitor.Logs.NATDestinationIP
  description: If destination NAT performed, the post-NAT destination IP address.
  type: string
- contextPath: Panorama.Monitor.Logs.NATDestinationPort
  description: Post-NAT destination port.
  type: string
- contextPath: Panorama.Monitor.Logs.NATSourceIP
  description: If source NAT performed, the post-NAT source IP address.
  type: string
- contextPath: Panorama.Monitor.Logs.NATSourcePort
  description: Post-NAT source port.
  type: string
- contextPath: Panorama.Monitor.Logs.PCAPid
  description: The packet capture (pcap) ID is a 64 bit unsigned integral denoting an ID to correlate threat pcap files with extended pcaps taken as a part of that flow. All threat logs contain either a pcap_id of 0 (no associated pcap), or an ID referencing the extended pcap file.
  type: string
- contextPath: Panorama.Monitor.Logs.IPProtocol
  description: IP protocol associated with the session.
  type: string
- contextPath: Panorama.Monitor.Logs.Recipient
  description: |-
    Specifies the name of the receiver of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
    Valid only for the WildFire subtype; all other types do not use this field.
  type: string
- contextPath: Panorama.Monitor.Logs.Rule
  description: Name of the rule that the session matched.
  type: string
- contextPath: Panorama.Monitor.Logs.RuleID
  description: ID of the rule that the session matched.
  type: string
- contextPath: Panorama.Monitor.Logs.ReceiveTime
  description: Time the log was received at the management plane.
  type: string
- contextPath: Panorama.Monitor.Logs.Sender
  description: |-
    Specifies the name of the sender of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
    Valid only for the WildFire subtype; all other types do not use this field.
  type: string
- contextPath: Panorama.Monitor.Logs.SessionID
  description: An internal numerical identifier applied to each session.
  type: string
- contextPath: Panorama.Monitor.Logs.DeviceSN
  description: The serial number of the firewall on which the session was logged.
  type: string
- contextPath: Panorama.Monitor.Logs.Severity
  description: Severity associated with the threat. Can be "informational", "low", "medium", "high", or "critical".
  type: string
- contextPath: Panorama.Monitor.Logs.SourceAddress
  description: Original session source IP address.
  type: string
- contextPath: Panorama.Monitor.Logs.SourceCountry
  description: Source country or internal region for private addresses. Maximum length is 32 bytes.
  type: string
- contextPath: Panorama.Monitor.Logs.SourceUser
  description: Username of the user who initiated the session.
  type: string
- contextPath: Panorama.Monitor.Logs.SourcePort
  description: Source port utilized by the session.
  type: string
- contextPath: Panorama.Monitor.Logs.Name
  description: Palo Alto Networks identifier for the threat. It is a description string followed by a 64-bit numerical identifier.
  type: string
- contextPath: Panorama.Monitor.Logs.ID
  description: Palo Alto Networks ID for the threat.
  type: string
- contextPath: Panorama.Monitor.Logs.ToZone
  description: The zone to which the session was sent.
  type: string
- contextPath: Panorama.Monitor.Logs.TimeGenerated
  description: Time that the log was generated on the dataplane.
  type: string
- contextPath: Panorama.Monitor.Logs.URLCategoryList
  description: A list of the URL filtering categories that the firewall used to enforce policy.
  type: string
- contextPath: Panorama.Monitor.Logs.Vsys
  description: Vsys on the firewall that generated the log.
  type: string
- contextPath: Panorama.Monitor.JobID
  description: Job ID of the log query.
- contextPath: Panorama.Monitor.Status
  description: Status of the log query.
  type: string
- contextPath: Panorama.Monitor.Message
  description: Message  of the log query.
  type: string
tests:
- Panorama Query Logs - Test
fromversion: 6.2.0
supportedModules:
- agentix
- xsiam