Palo Alto PAN-OS traffic
Palo Alto PAN-OS traffic. Session traffic and policy decisions.
Source and collection
Device logging subsystem / configured remote syslog or vendor export.
Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — line 1
One complete record selected; values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: 1127fd5c643752c9d5b4278800e1c9cc41de0ef282657600bc0b7f5f1580c66c
Nov 30 16:09:08 PA-220 1,2018/11/30 16:09:07,012801096514,TRAFFIC,end,2049,2018/11/30 16:09:07,192.168.15.207,175.16.199.1,192.168.1.63,175.16.199.1,new_outbound_from_trust,,,apple-maps,vsys1,trust,untrust,ethernet1/2,ethernet1/1,send_to_mac,2018/11/30 16:09:07,22751,1,55113,443,16418,443,0x400053,tcp,allow,7734,1758,5976,36,2018/11/30 15:59:04,586,computer-and-internet-info,0,32091112,0x0,192.168.0.0-192.168.255.255,United States,0,16,20,tcp-fin,0,0,0,0,,PA-220,from-policy,,,0,,0,,N/A,0,0,0,0
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
raw record | csv |
- Envelope
- Priority, timestamp and hostname depend on the transport format.
- Message payload
- Use the exact vendor message type and version, not a generic whitespace split.
Investigation uses
- Correlate session ID, source/destination, action, application and byte counters.
- Compare device event time and collector time; monitor drops and preserve the original message.
Validation boundaries
CSV layouts vary by release and configured forwarding format; a session-end record is different from a start record.
This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.