topic Re: Related Logs in Traffic Log - no URL-Filtering? in General Topics

Related Logs in Traffic Log - no URL-Filtering?

cryptochrome — Tue, 28 May 2013 18:56:24 GMT

Hi,

isn't the "Related Logs" field in the details of a traffic log entry supposed to list logs from other logging categories like URL-Filtering or Data-Filtering as well? I only seem to get other traffic logs in the related log field.

Example:

* outgoing web-browsing is allowed, logging is turned on

* URL-filtering is in place, logging is turned on (action: alert)

* User browses to www.wired.com, category "News" (I just made that up).

Result:

* I see the request in the URL-Filtering logs

* I see the request in traffic logs

BUT:

* I open the corresponding traffic log entry to see the details and look at the "related logs" field. Nothing from the URL-Filter shows up here. Even though it was logged.

It does work the other way around (looking at URL-Filter log entry details, related logs shows corresponding traffic log entries).

Is this a but? PanOS 5.02.

Re: Related Logs in Traffic Log - no URL-Filtering?

gswcowboy — Tue, 28 May 2013 19:26:09 GMT

Does it not show up as a 'threat' log?

Here's the URL log for session id 55307

General

Session ID	55307
Threat/Content Type	url
Action	alert
Application	web-browsing
Rule	test group
Category	computer-and-internet-info
Virtual System	vsys1
Device	001606002115

Threat/Content Name
ID
Severity	informational
IP Protocol	tcp
Log Action
Repeat Count	1
URL	www.speedtest.net/
Request Categorization Change

Source

Source User	amb\renato
Source address	172.16.20.2
Source Port	54739
Source Zone	L3_Trust
Inbound Interface	ethernet1/2
NAT Source IP	10.16.3.241
NAT Source Port	26212

Destination

Destination User
Destination address	72.21.92.20
Destination Port	80
Destination Zone	L3_Untrust
Outbound Interface	ethernet1/1
NAT Destination IP	72.21.92.20
NAT Destination Port	80

Time

Generate Time	2013/05/28 11:57:51
Receive Time	2013/05/28 11:57:52

Misc

Captive Portal
Proxy Transaction
Decrypted
Packet Capture
Direction	client-to-server

Related Logs (+/- 24 Hours)

	Receive Time	Log	Type	Application	Action	Rule	Bytes	Packets	Severity	Category	URL / Filename
	05/28 11:57:52	threat	url	web-browsing	alert	test group			informational	computer-and-internet-info	www.speedtest.net/
	05/28 11:58:39	traffic	end	web-browsing	allow	test group	10,271	20

Here's the traffic log for the same session ID

Session ID	55307
Type	end
Action	allow
Application	web-browsing
Rule	test group
Category	computer-and-internet-info
Virtual System	vsys1
Device	001606002115

IP Protocol	tcp
Log Action
Bytes	10,271
Bytes Received	8,546
Bytes Sent	1,725
Repeat Count	1
Packets	20
Packets Received	10
Packets Sent	10

Source

Source User	amb\renato
Source address	172.16.20.2
Source Country	172.16.0.0-172.31.255.255
Source Port	54739
Source Zone	L3_Trust
Inbound Interface	ethernet1/2
NAT Source IP	10.16.3.241
NAT Source Port	26212

Destination

Destination User
Destination address	72.21.92.20
Destination Country	US
Destination Port	80
Destination Zone	L3_Untrust
Outbound Interface	ethernet1/1
NAT Destination IP	72.21.92.20
NAT Destination Port	80

Time

Generate Time	2013/05/28 11:58:40
Start Time	2013/05/28 11:57:52
Receive Time	2013/05/28 11:58:39
Elapsed Time (sec)	18

Misc

Captive Portal
Proxy Transaction
Decrypted
Packet Capture
Client to Server
Server to Client

Related Logs (+/- 24 Hours)

	Receive Time	Log	Type	Application	Action	Rule	Bytes	Packets	Severity	Category	URL / Filename
	05/28 11:57:52	threat	url	web-browsing	alert	test group			informational	computer-and-internet-info	www.speedtest.net/
	05/28 11:58:39	traffic	end	web-browsing	allow	test group	10,271	20

Re: Related Logs in Traffic Log - no URL-Filtering?

cryptochrome — Tue, 28 May 2013 20:07:37 GMT

Thanks. That's strange. If I do a search on a specific session ID like you did, the related logs show up. If I randomly pick any other web-browsing traffic log, the related logs do not show.

Re: Related Logs in Traffic Log - no URL-Filtering?

gswcowboy — Tue, 28 May 2013 20:20:32 GMT

Searched traffic logs and found one where there was no correlating "URL" threat log. So I scoured the url logs and filtered by dst ip and src port equivalent to what was detected via the traffic log and sure enough, no URL log found .

Re: Related Logs in Traffic Log - no URL-Filtering?

cryptochrome — Tue, 28 May 2013 20:22:52 GMT

Not in my case. I definitely have corresponding URL logs that do not show up in related logs. 100%

Re: Related Logs in Traffic Log - no URL-Filtering?

gswcowboy — Tue, 28 May 2013 20:24:21 GMT

Perhaps a call into Support would be more feasible so we can dissect this further?

Re: Related Logs in Traffic Log - no URL-Filtering?

cryptochrome — Tue, 28 May 2013 20:55:20 GMT

will do. thanks for your help!