Traffic Logs have an http_category without a destination hostname or URL

thenetworksfine — Tue, 25 Feb 2020 15:41:34 GMT

I am seeing a pattern where I observe an http_category in my pan:traffic logs where log_subtype=end but there is no dest_hostname or URL. Is it possible that Palo is classifying based on IP address? We are not decrypting SSL traffic in this instance and I see no other corresponding logs for the same traffic (pan:threat).

Re: Traffic Logs have an http_category without a destination hostname or URL

reaper — Wed, 26 Feb 2020 09:00:37 GMT

could you provide a screenshot?

sessions toward an IP address that have url filtering enabled will also be checked against the url database

topic Traffic Logs have an http_category without a destination hostname or URL in General Topics

Traffic Logs have an http_category without a destination hostname or URL

Re: Traffic Logs have an http_category without a destination hostname or URL