General

This view provides a general overview of firewall activity in relation to relevant aspects such as protocol, app, action, log type, or subtype, as well as the traffic distribution over time.

This dashboard provides security teams with interactive widgets to visualize this data, including:

Total events by protocol
Total events by app
Total events by action
Total events by log type
Total events by subType
Traffic - every 5m

User Activity

This view provides insights on users triggering firewall activity, such as the most active users, the apps they use, or their distribution over time.

This dashboard provides security teams with interactive widgets to visualize this data, including:

Top 10 users
Top 10 apps (non ‘null’ srcUser)
Users - Every 1h

File Activity

This view provides details about files triggering firewall activity, with emphasis on the actions carried out on them, as well as their source and destination.

This dashboard provides security teams with key markers about this data, including:

Deny actions
Alert actions
Block continue actions

This dashboard also provides security teams with interactive widgets to visualize data, including:

Top 10 destination zones
Top 10 apps
Top 10 source zones
Top 10 categories
Blocked files - Every 1h

Web Activity

This view provides details about web-based actions that trigger firewall activity, divided in different areas of interest such as distinct counts, metrics, URL events over time, or geolocation of IPs.

This dashboard provides security teams with key markers in the Distinct counts area, including:

Distinct URLs
Distinct destination IPs
Distinct source IPs
Distinct sessions

This dashboard also provides interactive widgets to visualize data in the Metrics area, including:

Total events by category
Top 10 protocols
Total log types
Total URL events by app

In this dashboard you can also find an interactive widget under URL events over time to visualize that specific data over time.

Finally, you can find maps in the Geolocation of IPs area to see the geographical distribution of the firewall activity.

General Overview - Palo Alto