topic URL Filtering Log show Action block-url in General Topics

URL Filtering Log show Action block-url

BaNk — Tue, 24 Jun 2014 09:25:42 GMT

my palo alto I see url-filtering log

---in columns action show block-url

---in columns rule not show

and I don't add url-filtering profile to all security rule

why url-filtering show action block-url

help me pls.

PA5020 PanOS5.0.12

PAN-DB

Re: URL Filtering Log show Action block-url

mivaldi — Wed, 25 Jun 2014 18:23:16 GMT

To the left of the Receive Time column, there's a magnifying glass icon. If you click on it, it will open the Detailed Log View.

On the bottom you will see "Related Logs".

Check the line where action is block-url, right next to it you will see the associated Rule which is using an URL Filtering profile executing the action of block-url for that traffic.

Re: URL Filtering Log show Action block-url

BaNk — Mon, 30 Jun 2014 08:23:57 GMT

related logs columns rule not show.

Re: URL Filtering Log show Action block-url

mivaldi — Tue, 01 Jul 2014 00:36:22 GMT

That's very interesting, it could be that the AV, Anti-Spyware or Vulnerability Protection profile kicking in (perhaps a false positive), in that case you should see something for it on the Threat logs. Can you check there to see if you have an entry for the same 'Receive Time' ? Do you have AV/A-S or Vuln Protection profiles in your Security Policies ?

If you can't find something on the Threat Logs, please open a case with Palo Alto Networks support.