Palo Alto PAN-OS threat
Palo Alto PAN-OS threat. Threat log records; this fixture is a URL subtype.
Source and collection
Device logging subsystem / configured remote syslog or vendor export.
Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — line 1
One complete record selected; values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: 7844d4db038db89f0c650ac376a5a02fbff17b5a99e85397ab4d8eb531a4c62c
Nov 30 16:44:36 PA-220 1,2018/11/30 16:44:36,012801096514,THREAT,url,2049,2018/11/30 16:44:36,192.168.15.224,175.16.199.1,192.168.1.63,175.16.199.1,new_outbound_from_trust,,,ssl,vsys1,trust,untrust,ethernet1/2,ethernet1/1,send_to_mac,2018/11/30 16:44:36,28191,1,52984,443,37679,443,0x403000,tcp,block-url,"consent.cmp.oath.com/",(9999),business-and-economy,informational,client-to-server,7726,0x2000000000000000,192.168.0.0-192.168.255.255,United States,0,,0,,,0,,,,,,,,0,0,0,0,0,,PA-220,,,,,0,,0,,N/A,unknown,AppThreat-0-0,0x0,0,4294967295,
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
raw record | csv |
- Envelope
- Priority, timestamp and hostname depend on the transport format.
- Message payload
- Use the exact vendor message type and version, not a generic whitespace split.
Investigation uses
- Pivot from subtype and session ID to traffic and endpoint context.
- Compare device event time and collector time; monitor drops and preserve the original message.
Validation boundaries
Threat subtypes have different meanings; URL logging alone does not establish exploitation.
This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.