Palo Alto

LogZilla App Store application: Palo Alto

Overview

Palo Alto Networks next-generation firewalls running PAN-OS classify applications, users, and threats to secure network traffic. PAN-OS devices generate syslog messages for traffic flows, security threats, URL filtering, WildFire analysis, configuration changes, and system events.

The Palo Alto app parses these logs, extracts metadata into user tags, and reformats messages into readable key-value pairs for searching and alerting.

App Function

  • Detects and auto-classifies all PAN-OS log types: TRAFFIC, THREAT, SYSTEM, CONFIG, URL, WILDFIRE, TUNNEL, USERID, HIPMATCH, and DATA.
  • Parses key/value pairs from each event and stores them as user tags for fast filtering.
  • Extracts high-value threat fields: severity, threat name, direction, and application for SOC threat hunting.
  • Automatically converts numeric ports to friendly service names (e.g., 443 → https).
  • Normalizes geographic locations (RFC1918 ranges → "Internal").
  • Re-formats CSV messages into readable key/value pairs.
  • Ships with Security and Traffic dashboards plus high-priority triggers for critical threats, C2, malware, and data exfiltration.

LogZilla Configuration

The Palo Alto app requires a dedicated syslog port for Palo Alto events.

  1. Navigate to Settings > System > Application Ports
  2. Set Palo Alto syslog port to a dedicated port (e.g., 5518)
  3. Click Save

The syslog and parser services will reload automatically. Both TCP and UDP listeners are enabled on the configured port.

Vendor Documentation

Log Source Details

ItemValue
VendorPalo Alto Networks
Device TypeNext-Generation Firewall
Collection MethodSyslog (TCP/UDP)
Configurable Log Output?Yes
Log Source TypeCSV or Key-Value pairs

Incoming Log Formats

PAN-OS can output logs in two different ASCII formats, both of which are handled by the Palo Alto app:

  1. CSV syslog – the default format where each log is a comma-separated list of fields. The first few fields indicate the log type (e.g. TRAFFIC, THREAT).
  2. Custom key/value syslog – when a Custom Log Format is configured on the firewall the message is emitted as white-space separated key/value pairs (e.g. type="TRAFFIC" src="10.1.1.1" …).

Regardless of the on-device format, the app rewrites the event so the final stored message is an easy-to-read set of key/value pairs.

Parsed Metadata Fields

The following user tags are extracted from PAN-OS log messages.

Common Fields (All Log Types)

Tag NameExampleDescription
PA TypeTRAFFICLog type identifier
SrcIP192.168.1.100Source IP address
DstIP10.0.1.50Destination IP address
ActionallowAction taken
PA RuleAllow-WebSecurity rule name
Userdomain\userSource username
Applicationweb-browsingApp-ID identified application
PA Src LocationInternalSource geographic location
PA Dst LocationUnited StatesDestination geographic location
PA Device NamePA-440Device hostname

Traffic Log Fields

Tag NameExampleDescription
SrcNAT203.0.113.1NAT source IP
DstNAT203.0.113.2NAT destination IP
DstPorthttpsDestination port (service name)
ProtocoltcpProtocol
PA Action Sourcefrom-policyAction source
PA Session End Reasontcp-finSession termination reason

Threat Log Fields

Tag NameExampleDescription
PA SubtypevulnerabilityThreat subtype
PA Threat NameEicar File Detected(39040)Threat signature name and ID
PA SeveritycriticalThreat severity level
PA CategorymalwareThreat category
Directionclient-to-serverTraffic direction

URL Log Fields

Tag NameExampleDescription
PA URLmalware-site.net/downloadAccessed URL
PA CategoryphishingURL category

WildFire Log Fields

Tag NameExampleDescription
PA Filenamemalware.exeAnalyzed filename
PA CategorymalwareWildFire verdict

HIP Match Log Fields

Tag NameExampleDescription
PA Machine NameDESKTOP-ABC123Endpoint machine name
PA OSWindowsEndpoint operating system
PA HIP ProfileCompliantHIP profile match

Config Log Fields

Tag NameExampleDescription
PA AdminadminAdministrator username
PA Client IP192.168.50.76Admin client IP
PA ResultSucceededConfiguration result

System Log Fields

Tag NameExampleDescription
PA Content TypegeneralContent type
PA Event IDgeneralEvent identifier

Device Configuration

Configure Syslog Server Profile

  1. Navigate to Device > Server Profiles > Syslog and click Add
  2. Enter a Name for the profile
  3. If the firewall has multiple virtual systems, select the Location (vsys or Shared)
  4. In the Servers tab, click Add and configure:
    • Name: Unique name for the server entry
    • Syslog Server: LogZilla server IP address or FQDN
    • Transport: TCP (recommended), UDP, or SSL
    • Port: 5518 (dedicated Palo Alto port)
    • Format: BSD (default) or IETF
    • Facility: LOG_USER (default)
  5. Click OK to save the server profile

Configure Syslog Hostname Format (Optional)

  1. Navigate to Device > Setup > Management
  2. Click the Edit icon in the Logging and Reporting Settings section
  3. Select the Log Export and Reporting tab
  4. Set Syslog HOSTNAME Format to one of:
    • FQDN (default) - hostname and domain name
    • hostname - hostname only
    • ipv4-address - IPv4 address of sending interface
    • ipv6-address - IPv6 address of sending interface
  5. Click OK to save

Configure Custom Log Formats

Threat Log Format

Select Custom Log Format tab, choose Threat, and paste:

text
PaloAlto_Threat type="$type" src="$src" dst="$dst" rule="$rule" srcuser="$srcuser" sessionid="$sessionid" action="$action" misc="$misc" dstloc="$dstloc" referer="$referer" http_method="$http_method" http_headers="$http_headers"

Traffic Log Format

Select Custom Log Format tab, choose Traffic, and paste:

text
PaloAlto_Traffic type="$type" src="$src" dst="$dst" natsrc="$natsrc" natdst="$natdst" rule="$rule" srcuser="$srcuser" from="$from" to="$to" sessionid="$sessionid" sport="$sport" dport="$dport" natsport="$natsport" natdport="$natdport" proto="$proto" action="$action" bytes="$bytes" packets="$packets" dstloc="$dstloc" action_source="$action_source"

Save and commit all configuration changes

Log Examples

Traffic Log (CSV Format)

text
1,2025/07/03 10:15:30,021201157768,TRAFFIC,end,2817,2025/07/03 10:15:30,
192.168.50.100,8.8.8.8,0.0.0.0,0.0.0.0,Allow-DNS,,,dns,vsys1,trust,untrust,
ethernet1/1,ethernet1/2,,2025/07/03 10:15:30,12345,1,53,53,0,0,0x0,udp,allow,
150,150,0,1,2025/07/03 10:15:28,2,any,0,1234567890,0x0,US,US,0,1,0,aged-out,0,
0,0,0,,PA-440,from-policy

Threat Log (CSV Format)

text
1,2025/07/03 11:22:45,021201157768,THREAT,url,2817,2025/07/03 11:22:45,
192.168.50.50,203.0.113.100,0.0.0.0,0.0.0.0,Block-Malware,domain\jsmith,,
web-browsing,vsys1,trust,untrust,ethernet1/1,ethernet1/2,,2025/07/03 11:22:45,
54321,1,54321,80,0,0,0x0,tcp,block-url,"malware.example.com/payload",
malware(12345),informational,client-to-server,1234567891,0x0,US,RU,0,
text/html,,,,,0x0,,,,,,,,,PA-440

System Log (CSV Format)

text
1,2025/07/03 09:29:05,021201157768,SYSTEM,general,2817,2025/07/03 09:29:05,,
general,,0,0,general,informational,"Connection to Update server:
updates.paloaltonetworks.com completed successfully, initiated by
192.168.50.2",7520354041554025364,0x8000000000000000,0,0,0,0,,PA-440,0,0,
2025-07-03T09:29:47.040-06:00

Config Log (CSV Format)

text
1,2025/07/03 09:29:36,021201157768,CONFIG,0,2817,2025/07/03 09:29:37,
192.168.50.76,,edit,admin,Web,Succeeded,network interface ethernet
ethernet1/3,7520354041554010118,0x8000000000000000,0,0,0,0,,PA-440,0,,0,
2025-07-03T09:29:37.609-06:00

Custom Key-Value Format (Traffic)

text
PaloAlto_Traffic type="TRAFFIC" src="192.168.1.100" dst="203.0.113.50"
natsrc="203.0.113.1" natdst="203.0.113.50" rule="Allow-Web"
srcuser="domain\jdoe" from="trust" to="untrust" sessionid="54321"
sport="54321" dport="443" proto="tcp" action="allow" bytes="2048"
packets="15" dstloc="US" action_source="from-policy"

Custom Key-Value Format (Threat)

text
PaloAlto_Threat type="THREAT" src="192.168.1.100" dst="203.0.113.50"
rule="Allow-Web" srcuser="domain\jdoe" sessionid="54321" action="alert"
misc="" dstloc="US" referer="https://example.com" http_method="GET"
http_headers="User-Agent: Mozilla/5.0"

Triggers

TriggerDescription
Palo Alto: Critical/High Severity ThreatCritical or high severity threat detected
Palo Alto: Command and Control DetectedC2 traffic detected (immediate investigation)
Palo Alto: Malware/Spyware DetectedVirus, spyware, or WildFire malware
Palo Alto: Phishing DetectedPhishing category URL or threat
Palo Alto: Threat DetectedGeneral threat with block/drop/reset action
Palo Alto: Traffic DeniedTraffic denied or dropped
Palo Alto: Configuration Change FailedFailed configuration change
Palo Alto: Configuration ChangeConfiguration change with admin context
Palo Alto: Data Exfiltration AttemptDATA filtering/DLP event
Palo Alto: WildFire Malware DetectedWildFire malware verdict
Palo Alto: Endpoint HIP CheckGlobalProtect HIP profile match
Palo Alto: System EventSystem events with content type
Palo Alto: System ErrorSystem errors or critical events
Palo Alto | LogZilla Documentation