Palo Alto Networks NGFW

Download 0
Last updated May 24, 2022

paloalto-ngfw-traffic-logs

Read traffic logs using PAN-OS XML API.

paloalto-ngfw-traffic-logs [profile=PROFILE] [order=ORDER] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]
profile=PROFILE
The identifier of Palo Alto Networks NGFW
order=ORDER
Retrieve direction. desc or asc.
duration=NUM{mon|w|d|h|m|s}
Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss
Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss
End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.

Output Fields

FieldTypeNameDescription
_timeDateTime
profileStringConnect profileThe identifier of Palo Alto Networks NGFW connect profile
serialStringSerial
typeStringTypee.g. TRAFFIC
subtypeStringSubtypee.g. start, end, drop
src_userStringSource user
src_ipIP addressSource IP
src_portIntegerSource port
dst_ipIP addressDestination IP
dst_portIntegerDestination port
protocolStringProtocole.g. TCP, UDP, ICMP
appStringAppe.g. incomplete, dns, ldap, ssl, kerberos, web-browsing, ntp
categoryStringCategorye.g. any, news, internet-portals, computer-and-internet-info
policyStringPolicy
actionStringActione.g. PERMIT, DROP
durationIntegerDuration
session_end_reasonStringSession end reasone.g. aged-out, n/a, tcp-fin, tcp-rst-from-server, tcp-rst-from-client, policy-deny
tunnelStringTunnel
tunnel_idIntegerTunnel ID
nat_src_ipIP addressNAT source IP
nat_src_portIntegerNAT source port
nat_dst_ipIP addressNAT destination IP
nat_dst_portIntegerNAT destination port
total_pktsLongTotal packets
sent_pktsLongSent packets
rcvd_pktsLongReceived packets
total_bytesLongTotal bytes
sent_bytesLongSent bytes
rcvd_bytesLongReceived bytes
src_zoneStringSource zonee.g. intranet, untrust
dst_zoneStringDestination zonee.g. intranet, untrust
src_ifaceStringSource interfacee.g. ethernet1/1
dst_ifaceStringDestination interfacee.g. ethernet1/1
total_chunksStringTotal chunks
sent_chunksIntegerSent chunks
rcvd_chunksIntegerReceived chunks
src_locStringSource locatione.g. 10.0.0.0-10.255.255.255
dst_locStringDestination locatione.g. 10.0.0.0-10.255.255.255