Equipment: PA1410 (PAN-OS 11.1.4-h1) Threat Logs is not monitored every time

nabin.sutradhar — Thu, 19 Dec 2024 11:30:19 GMT

Equipment: PA1410 (PAN-OS 11.1.4-h1)
Issue: Some threat logs are not seen in output.
Details:
・The vulnerability protection alert test was performed 4 times on PA1410 with reference to the following page.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpPCAS
-1st time (2024/12/14 15:29:58): A threat log was seen as output from Monitor > Threat in the Web UI.
-Second time ( 2024/12/14 17:34): The threat log was not seen as output in Monitor > Threat in the Web UI.
-Third time (2024/12/16 8:41:52): A threat log was seen as output in Monitor > Threat in the Web UI.
-Fourth time (2024/12/16 10:29): The threat log was not seen as output in Monitor > Threat in the Web UI.

・The CLI command show log threat also did not print the second and fourth logs.
・I checked the results of show counter global one hour after the second communication and two hours after the fourth communication, but log_threat_loss_cnt did not count up in either case.

Does anyone know the cause of this issue?

Re: Equipment: PA1410 (PAN-OS 11.1.4-h1) Threat Logs is not monitored every time

BPry — Mon, 23 Dec 2024 16:29:50 GMT

@nabin.sutradhar,

Kind of sounds like the firewall just simply didn't see the threat. Where you doing it on a decrypted page? Did the traffic hit a rule that was set to log threats properly?

topic Equipment: PA1410 (PAN-OS 11.1.4-h1) Threat Logs is not monitored every time in General Topics

Equipment: PA1410 (PAN-OS 11.1.4-h1) Threat Logs is not monitored every time

Re: Equipment: PA1410 (PAN-OS 11.1.4-h1) Threat Logs is not monitored every time