firewall.paloalto

Reference vendor documentation	System Log Fields

Introduction

The tags that begin with firewall.paloalto identify events generated by Palo Alto Networks Firewall.

Tag structure

The full tag must have at least three levels. The first two are fixed as firewall.paloalto. The third level identifies the event's log type and will be determined dynamically by the rule you define in the Devo Relay. The fourth element is only used in some specific cases.

Technology

Brand

Type

Subtype

firewall

paloalto

config
system
threat
traffic
correlation
hipmatch
url
userid

The tag levels below are only used with firewall.paloalto.config

This is used to indicate the parser version. Depending on the Palo Alto firewall version used by each client, some fields can arrive in a different order, so we need to add this tag level to indicate the parser version. The possible values are:

v1 - This is the default value, also used if no value is set at this level. In this case, the parser uses the default field order (fields affected: seqno, actionflags, beforechangedetail and afterchangedetail).
v2 - Used to indicate that the fields beforechangedetail and afterchangedetail are not part of the event and must be ignored and initialized with null.
v3 - Used to indicate that the fields beforechangedetail and afterchangedetail come before the seqno and actionflags fields.

The tag level below is only used with

firewall.paloalto.traffic
firewall.paloalto.system
firewall.paloalto.url
firewall.paloalto.threat

These tables allow sending events in LEEF format instead of the default CSV format. To indicate this, all logs must have an additional tag level (leef). Threats can also have logs in JSON format using the tag level JSON at the end.

CSV format tags are:

firewall.paloalto.traffic
firewall.paloalto.system
firewall.paloalto.threats
firewall.paloalto.url

These are the valid tags and corresponding data tables that will receive the parsers' data:

Tag	Data table
`firewall.paloalto.all`	`firewall.paloalto.all`
`firewall.paloalto.auth`	`firewall.paloalto.auth`
`firewall.paloalto.config` `firewall.paloalto.config.v1` `firewall.paloalto.config.v2` `firewall.paloalto.config.v3`	`firewall.paloalto.config`
`firewall.paloalto.correlation`	`firewall.paloalto.correlation`
`firewall.paloalto.decryption`	`firewall.paloalto.decryption`
`firewall.paloalto.globalprotect`	`firewall.paloalto.globalprotect`
`firewall.paloalto.hipmatch`	`firewall.paloalto.hipmatch`
`firewall.paloalto.iptag`	`firewall.paloalto.iptag`
`firewall.paloalto.system`	`firewall.paloalto.system`
`firewall.paloalto.system.leef`	`firewall.paloalto.system`
`firewall.paloalto.threat`	`firewall.paloalto.threat`
`firewall.paloalto.threat.leef`	`firewall.paloalto.threat`
`firewall.paloalto.threat.json`	`firewall.paloalto.threat`
`firewall.paloalto.traffic.leef`	`firewall.paloalto.traffic`
`firewall.paloalto.url`	`firewall.paloalto.url`
`firewall.paloalto.url.leef`	`firewall.paloalto.url`
`firewall.paloalto.userid`	`firewall.paloalto.userid`

For more information, read more about Devo tags.

How is the data sent to Devo?

Since there is no functionality to apply the Devo tag in the source system, the events should be forwarded to a Devo Relay to be identified, tagged, and then forwarded securely to the Devo Cloud.

You will need to define a relay rule that can correctly identify the event type and apply the corresponding tag. The event type is determined by the source port specified when creating the rule and by whether it matches a format defined by a regular expression. When the source conditions are met, the relay will apply a tag that begins with firewall.paloalto. A regular expression in the Source data field describes the format of the event data. Data is extracted from the event and used to create the third tag level.

Define the rule using the following values (the port number can be any free port on your relay):

Relay rule 1 - CSV events

Source port → 13004
Source data → ([^,]+,){3}([^,]+)
Target tag → firewall.paloalto.\\D2
Target message → \\D0

Check the Sent without syslog tag and Stop processing checkboxes.

Relay rule 2 - LEEF events

Source port → 13004
Source data → LEEF:(?:[^\|]+\|){4}([^\|]+)\|.*$
Target tag → firewall.paloalto.\\D1.leef

Check the Sent without syslog tag and Stop processing checkboxes.

Note that the number between curly braces in the rules above may vary depending on your firewall version and the format of your events. Contact us if you need assistance.

Palo Alto Firewall configuration

In Pan-OS, you will need to create a Syslog Server Pron Pan-OS and a Syslog Server Profile for your Devo Relay, as well as the necessary Log Forwarding Profiles and Security Policy Rules. See the vendor documentation for instructions.

If you want to send your Palo Alto firewall events to a Devo relay that exist in a different network, check out the article about sending events to the Devo relay using SSL.

Table structure

These are the fields displayed in these tables:

firewall.paloalto.system
firewall.paloalto.threat
firewall.paloalto.traffic

firewall.paloalto.system

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
machine	`str`
timestamp	`timestamp`
recvdate	`timestamp`
serial	`str`
subType	`str`
vsys	`str`
eventId	`str`
object	`str`
future_use_4	`str`
future_use_5	`str`
module	`str`
severity	`str`
description	`str`	opaque
client_ip	`ip4`
client_port	`str`
user_name	`str`
seqno	`int8`
actionflags	`str`
dev_group_hierarchy_1	`int8`
dev_group_hierarchy_2	`int8`
dev_group_hierarchy_3	`int8`
dev_group_hierarchy_4	`int8`
virtual_sys_name	`str`
log_source_name	`str`
device_name	`str`
reason	`str`
protocol	`str`
high_res_timestamp	`timestamp`	high_res_timestamp_fmt high_res_timestamp_tmp
auth_username	`str`
auth_srcIp	`ip4`
auth_status	`str`
lease_ip_address	`str`
lease_hardware_address	`str`
src_host	`str`
interface	`str`
lease_time_of	`str`
server_ip	`str`
server_mask	`str`
gateway	`str`
dns1	`str`
dns2	`str`
dns_sufix	`str`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

firewall.paloalto.threat

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
machine	`str`
timestamp	`timestamp`	createdate
recvdate	`timestamp`
serial	`str`
subType	`str`
vendor	`str`
product	`str`
version	`str`
event_id	`int8`
delimiter	`str`
srcIp	`ip4`
dstIp	`ip4`
srcNatIp	`ip4`	srcXIp
dstNatIp	`ip4`	dstXIp
srcIp_str	`str`
rule	`str`
srcUser	`str`
dstUser	`str`
app	`str`
virtSys	`str`
srcZone	`str`
dstZone	`str`
srcIface	`str`
dstIface	`str`
logForwardingProfile	`str`
logAction	`str`
session	`str`
repCnt	`int4`
srcPort	`int4`
dstPort	`int4`
srcNatPort	`int4`	srcXPort
dstNatPort	`int4`	dstXPort
flags	`str`
proto	`str`
action	`str`
url_filename	`str`	misc
threatid	`str`
category	`str`
severity	`str`
sevNum	`str`
direction	`str`
seqno	`int8`
actionflags	`str`
srcloc	`str`
dstloc	`str`
cpadding	`int4`
contenttype	`str`
pcap_id	`str`
src_category	`str`
dst_category	`str`
threatname	`str`
pcapId	`int8`	pcadId
fileDigest	`str`
cloud	`str`
urlIdx	`int4`
userAgent	`str`
fileType	`str`
xff	`str`
referer	`str`
sender	`str`
subject	`str`
recipient	`str`
reportid	`int8`
dgHierLevel1	`int4`
dgHierLevel2	`int4`
dgHierLevel3	`int4`
dgHierLevel4	`int4`
vsysName	`str`
deviceName	`str`
srcVMuuid	`str`
dstVMuuid	`str`
httpMethod	`str`
tunnelIDimsi	`str`
monitorTagIMEI	`str`
parentSessID	`int8`
parentStartTime	`timestamp`
tunnel	`str`
thrCategory	`str`
contentver	`str`
sctpAssociationID	`int8`
payloadProtocolID	`int8`
httpHeaders	`str`
url	`str`
urlCategory	`str`
urlCategoryList	`str`
uuidForRule	`str`
http2Connection	`str`
dynusergroup_name	`str`
xff_ip	`str`
src_profile	`str`
src_model	`str`
src_vendor	`str`
src_osfamily	`str`
src_osversion	`str`
src_host	`str`
src_mac	`str`
dst_profile	`str`
dst_model	`str`
dst_vendor	`str`
dst_osfamily	`str`
dst_osversion	`str`
dst_host	`str`
dst_mac	`str`
container_id	`str`
pod_namespace	`str`
src_edl	`str`
dst_edl	`str`
hostid	`str`
serialnumber	`str`
domain_edl	`str`
src_dag	`str`
dst_dag	`str`
partial_hash	`str`
high_res_timestamp	`timestamp`
nsdsai_sst	`str`
log_type	`str`
xff_address	`str`
source_external_dynamic_list	`str`
destination_external_dynamic_list	`str`
source_dynamic_address_group	`str`
destination_dynamic_address_group	`str`
justification	`str`
slice_service_type	`str`
application_subcategory	`str`
application_category	`str`
application_technology	`str`
application_risk	`str`
application_characteristic	`str`
application_container	`str`
tunneled_application	`str`
application_saas	`str`
application_sanctioned_state	`str`
cloud_report_id	`str`
cluster_name	`str`
flow_type	`str`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

firewall.paloalto.traffic

Field	Type	Field transformation	Source field name	Extra fields
eventdate	`timestamp`
machine	`str`
timestamp	`timestamp`		createdate
recvdate	`timestamp`
serial	`str`
subType	`str`
srcIp	`ip4`
dstIp	`ip4`
srcNatIp	`ip4`		srcXIp
dstNatIp	`ip4`		dstXIp
srcIp_str	`str`
dstIp_str	`str`
rule	`str`
srcUser	`str`
dstUser	`str`
app	`str`
virtSys	`str`
srcZone	`str`
dstZone	`str`
srcIface	`str`
dstIface	`str`
logAction	`str`
session	`str`
repCnt	`int4`
srcPort	`int4`
dstPort	`int4`
srcNatPort	`int4`		srcXPort
dstNatPort	`int4`		dstXPort
flags	`str`
proto	`str`
action	`str`
bytes	`int8`
sentBytes	`int8`
recvBytes	`int8`
pkts	`int4`
startdate	`timestamp`
elapsedTime	`int8`
category	`str`
padding	`int4`
seqno	`int8`
actionFlags	`str`
srcCountry	`str`
dstCountry	`str`
cpadding	`int4`
sentPkts	`int4`
recvPkts	`int4`
session_end_reason	`str`
dg_hier_level_1	`int4`
dg_hier_level_2	`int4`
dg_hier_level_3	`int4`
dg_hier_level_4	`int4`
vsys_name	`str`
device_name	`str`
action_source	`str`
srcVMuuid	`str`
dstVMuuid	`str`
tunnelIDimsi	`str`
monitorTagIMEI	`str`
parentSessID	`int4`
parentStartTime	`timestamp`
tunnel	`str`
sctpAssociationID	`int4`
sctpChunks	`int8`
sctpChunksSent	`int8`
sctpChunksReceived	`int8`
uuidForRule	`str`
http2Connection	`str`
link_change_count	`str`
policy_id	`str`
link_switches	`str`
sdwan_cluster	`str`
sdwan_device_type	`str`
sdwan_cluster_type	`str`
sdwan_site	`str`
dynusergroup_name	`str`
xff_ip	`str`
src_category	`str`
src_profile	`str`
src_model	`str`
src_vendor	`str`
src_osfamily	`str`
src_osversion	`str`
src_host	`str`
src_mac	`str`
dst_category	`str`
dst_profile	`str`
dst_model	`str`
dst_vendor	`str`
dst_osfamily	`str`
dst_osversion	`str`
dst_host	`str`
dst_mac	`str`
container_id	`str`
pod_namespace	`str`
pod_name	`str`
src_edl	`str`
dst_edl	`str`
hostid	`str`
serialnumber	`str`
src_dag	`str`
dst_dag	`str`
session_owner	`str`
high_res_timestamp	`timestamp`	ifthenelse(isnotnull(high_res_timestamp_fmt), parsedate(high_res_timestamp_tmp, dateformat(high_res_timestamp_fmt)), null(timestamp(0)))	high_res_timestamp_fmt high_res_timestamp_tmp
nsdsai_sst	`str`
nsdsai_sd	`str`
app_category	`str`
app_subcategory	`str`
app_technology	`str`
app_risk	`int4`
app_characteristic	`str`
app_container	`str`
app_tunneled	`str`
app_saas	`str`
app_sanctioned_state	`str`
offloaded	`str`
flow_type	`str`
cluster_name	`str`
devTimeFormat	`str`
hostchain	`str`			✓
tag	`str`			✓
rawMessage	`str`			✓