PANOSQueryLogs

commonfields:
  id: PANOSQueryLogs
  version: -1
name: PANOSQueryLogs
script: ''
type: python
tags:
- Utilities
comment: |-
  A polling wrapper script; This script searches Palo Alto Networks firewall logs across eight different log types (threat, traffic, wildfire, URL, data, correlation, system, and decryption). It provides flexible filtering capabilities including IP addresses, time ranges, network zones, rules, ports, URLs, file hashes, and custom query strings, with configurable result limits up to 5,000 logs. This tool enables security teams to efficiently investigate network activity, analyze traffic patterns, and perform forensic analysis across their Panorama and Firewall infrastructure through automated log retrieval. This script depends on the Panorama integration and can be executed against either a Firewall device or a Panorama device, depending on the configured integration instance.
enabled: true
args:
- description: The log type.
  name: log_type
  required: true
  auto: PREDEFINED
  predefined:
  - threat
  - traffic
  - wildfire
  - url
  - data
  - corr
  - system
  - decryption
- description: |-
    Filters logs by a specific URL category. Optional values are: 
    1. Malware
    2. Phishing
    3. Command and Control
    4. Dynamic DNS
    5. Encrypted DNS
    6. Parked
    7. Unknown
    8. Newly Registered Domains
    9. Grayware
    10. Hacking
    11. Proxy Avoidance And Anonymizers
    12. Ransomware
    13. Scanning Activity
    14. Artificial Intelligence
    15. High Risk
    16. Compromised Website

    This argument cannot be used in combination with the following arguments: time-generated, time-generated-after, addr-src, addr-dst, zone-src, zone-dst, action, port-dst, rule, url, filedigest. It can only be used with log_type set to "url". For all other log_type values, this argument is ignored.
  name: url_category
- description: |-
    The time the log was generated from the timestamp and prior to it.
    For example "2019/08/11 01:10:44, will get logs before the specified date.".
  name: time_generated
- description: |-
    The time the log was generated from the timestamp and prior to it.
    For example "2019/08/11 01:10:44", will get logs after the specified date.
  name: time_generated_after
- description: The source address.
  name: addr_src
- description: The destination address.
  name: addr_dst
- description: The source or destination IP address.
  name: ip
- description: The source zone.
  name: zone_src
- description: The destination source.
  name: zone_dst
- description: The rule action.
  name: action
- description: The destination port.
  name: port_dst
- description: The rule name, for example "Allow all outbound".
  name: rule
- description: The URL, for example "safebrowsing.googleapis.com".
  name: url
- description: The file hash (for WildFire logs only).
  name: filedigest
- defaultValue: '100'
  description: The maximum number of logs to retrieve. If empty, the default is 100. The maximum is 5,000.
  name: number_of_logs
- description: Whether to show only `after-change-preview`, and `before-change-preview`, or get full data for it.  The full data are under the fields `after-change-detail`, and `before-change-detail`.
  name: show_detail
  predefined:
  - yes
  - no
  auto: PREDEFINED
  defaultValue: no
outputs:
- contextPath: Panorama.Monitor.JobID
  description: The job ID of the logs query.
  type: String
- contextPath: Panorama.Monitor.Status
  description: The status of the logs query.
  type: String
- contextPath: Panorama.Monitor.Message
  description: The message of the logs query.
  type: String
- contextPath: Panorama.Monitor.Logs.Action
  description: The action taken for the session. Can be "alert", "allow", "deny", "drop", "drop-all-packets", "reset-client", "reset-server", "reset-both", or "block-url".
  type: String
- contextPath: Panorama.Monitor.Logs.Application
  description: The application associated with the session.
  type: String
- contextPath: Panorama.Monitor.Logs.Category
  description: The URL category of the URL subtype. For WildFire subtype, it is the verdict on the file, and can be either "malicious", "phishing", "grayware", or "benign". For other subtypes, the value is "any".
  type: String
- contextPath: Panorama.Monitor.Logs.DeviceName
  description: The hostname of the firewall on which the session was logged.
  type: String
- contextPath: Panorama.Monitor.Logs.DestinationAddress
  description: The original session destination IP address.
  type: String
- contextPath: Panorama.Monitor.Logs.DestinationUser
  description: The username of the user to which the session was destined.
  type: String
- contextPath: Panorama.Monitor.Logs.DestinationCountry
  description: The destination country or internal region for private addresses. Maximum length is 32 bytes.
  type: String
- contextPath: Panorama.Monitor.Logs.DestinationPort
  description: The destination port utilized by the session.
  type: String
- contextPath: Panorama.Monitor.Logs.FileDigest
  description: Only for the WildFire subtype, all other types do not use this field. The filedigest string shows the binary hash of the file sent to be analyzed by the WildFire service.
  type: String
- contextPath: Panorama.Monitor.Logs.FileName
  description: |-
    File name or file type when the subtype is file.
    File name when the subtype is virus.
    File name when the subtype is wildfire-virus.
    File name when the subtype is wildfire.
  type: String
- contextPath: Panorama.Monitor.Logs.FileType
  description: |-
    Only for the WildFire subtype, all other types do not use this field.
    Specifies the type of file that the firewall forwarded for WildFire analysis.
  type: String
- contextPath: Panorama.Monitor.Logs.FromZone
  description: The zone from which the session was sourced.
  type: String
- contextPath: Panorama.Monitor.Logs.URLOrFilename
  description: |-
    The actual URL when the subtype is url.
    The file name or file type when the subtype is file.
    The file name when the subtype is virus.
    The file name when the subtype is wildfire-virus.
    The file name when the subtype is wildfire.
    The URL or file name when the subtype is vulnerability (if applicable).
  type: String
- contextPath: Panorama.Monitor.Logs.NATDestinationIP
  description: The post-NAT destination IP address if destination NAT was performed.
  type: String
- contextPath: Panorama.Monitor.Logs.NATDestinationPort
  description: The post-NAT destination port.
  type: String
- contextPath: Panorama.Monitor.Logs.NATSourceIP
  description: The post-NAT source IP address if source NAT was performed.
  type: String
- contextPath: Panorama.Monitor.Logs.NATSourcePort
  description: The post-NAT source port.
  type: String
- contextPath: Panorama.Monitor.Logs.PCAPid
  description: |-
    The packet capture (pcap) ID is a 64 bit unsigned integral denoting
    an ID to correlate threat pcap files with extended pcaps taken as a part of
    that flow. All threat logs will contain either a pcap_id of 0 (no associated
    pcap), or an ID referencing the extended pcap file.
  type: String
- contextPath: Panorama.Monitor.Logs.IPProtocol
  description: The IP protocol associated with the session.
  type: String
- contextPath: Panorama.Monitor.Logs.Recipient
  description: |-
    Only for the WildFire subtype, all other types do not use this field.
    Specifies the name of the receiver of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
  type: String
- contextPath: Panorama.Monitor.Logs.Rule
  description: The name of the rule that the session matched.
  type: String
- contextPath: Panorama.Monitor.Logs.RuleID
  description: The ID of the rule that the session matched.
  type: String
- contextPath: Panorama.Monitor.Logs.ReceiveTime
  description: The time the log was received at the management plane.
  type: String
- contextPath: Panorama.Monitor.Logs.Sender
  description: |-
    Only for the WildFire subtype; all other types do not use this field.
    Specifies the name of the sender of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
  type: String
- contextPath: Panorama.Monitor.Logs.SessionID
  description: An internal numerical identifier applied to each session.
  type: String
- contextPath: Panorama.Monitor.Logs.DeviceSN
  description: The serial number of the firewall on which the session was logged.
  type: String
- contextPath: Panorama.Monitor.Logs.Severity
  description: |-
    The severity associated with the threat. Can be "informational", "low",
    "medium", "high", or "critical".
  type: String
- contextPath: Panorama.Monitor.Logs.SourceAddress
  description: The original session source IP address.
  type: String
- contextPath: Panorama.Monitor.Logs.SourceCountry
  description: |-
    The source country or internal region for private addresses. Maximum
    length is 32 bytes.
  type: String
- contextPath: Panorama.Monitor.Logs.SourceUser
  description: The username of the user who initiated the session.
  type: String
- contextPath: Panorama.Monitor.Logs.SourcePort
  description: The source port utilized by the session.
  type: String
- contextPath: Panorama.Monitor.Logs.ThreatCategory
  description: |-
    The threat categories used to classify different types of
    threat signatures.
  type: String
- contextPath: Panorama.Monitor.Logs.Name
  description: |-
    The Palo Alto Networks identifier for the threat. A description
    string followed by a 64-bit numerical identifier.
  type: String
- contextPath: Panorama.Monitor.Logs.ID
  description: The Palo Alto Networks ID for the threat.
  type: String
- contextPath: Panorama.Monitor.Logs.ToZone
  description: The zone to which the session was destined.
  type: String
- contextPath: Panorama.Monitor.Logs.TimeGenerated
  description: The time the log was generated on the data plane.
  type: String
- contextPath: Panorama.Monitor.Logs.URLCategoryList
  description: |-
    A list of the URL filtering categories the firewall used to
    enforce the policy.
  type: String
- contextPath: Panorama.Monitor.Logs.Bytes
  description: The total log bytes.
  type: String
- contextPath: Panorama.Monitor.Logs.BytesReceived
  description: The log bytes received.
  type: String
- contextPath: Panorama.Monitor.Logs.BytesSent
  description: The log bytes sent.
  type: String
- contextPath: Panorama.Monitor.Logs.Vsys
  description: The VSYS on the firewall that generated the log.
  type: String
scripttarget: 0
subtype: python3
dockerimage: demisto/python3:3.12.13.10116658
dependson:
  must:
  - pan-os-query-logs
fromversion: 6.1.0
isInternal: true
tests:
- No tests (auto formatted)
marketplaces:
- platform