Logs are how you prove what the firewall did and how you feed a security operations center (SOC). PAN-OS writes many log types, visible under Monitor > Logs. The ones you will use most are Traffic (a record of each session, by default written at session end), Threat (vulnerability, spyware, virus, flood and scan detections), URL Filtering, WildFire Submissions, Data Filtering, HIP Match, GlobalProtect, User-ID, IP-Tag, Decryption, Tunnel Inspection, Authentication, Configuration, System and Alarms. The Unified log view combines several types for one search, and filters such as ( addr.src in 10.1.1.5 ) and ( action eq deny ) narrow results quickly.
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 6 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.