Inline Cloud Analyze Event Threat missing XFF_IP

Alexander Schrader — Wed, 03 Jan 2024 16:04:35 GMT

Hi, is there a reason why specific events (e.g. Inline Cloud Analyzed SQL Injection Traffic Detection) do not contain an XFF_IP entry?

Host	abc
Service	Events Threat
Event	OK -> CRIT
IP	10.y.z.w
Date/Time	2023-12-13 19:50:48
Summary	CRIT - 1 events (1 unacknowledged), worst state is CRIT (Last line: vulnerability:reset-both:high:1:2023/12/13 19:44:14:566653:src:10.x.y.z:dst:10.x.y.z:Inline Cloud Analyzed SQL Injection Traffic Detection(99950):xff_ip🙂

Other threat alerts show these entries:

Host	abc
Service	Events Threat
Event	OK -> CRIT
IP	10.y.z.x
Date/Time	2023-12-19 13:04:20
Summary	CRIT - 1 events (1 unacknowledged), worst state is CRIT (Last line: vulnerability:reset-both:critical:1:2023/12/19 12:59:28:383117:src:10.x.y.z:dst:10.y.z.w:WordPress Backup Migration Plugin Remote Code Execution Vulnerability(94778):xff_ip:45.x.y.z)

PAN-OS 11.02

topic Inline Cloud Analyze Event Threat missing XFF_IP in Next-Generation Firewall Discussions