How to Enable HTTP Header Logging and Track URLs Accessed by Users

PAN-OS 6.1

Overview

HTTP header logging was introduced in PAN-OS 6.1. This document explains how to enable the HTTP header logging and how to track URLs accessed by individual users in the network.

Steps

1. Configure a URL Filtering Profile under Objects > Security Profiles.
   
2. Configure necessary actions for each respective category.
3. Navigate to settings in the URL filtering profile and enable User-Agent, Referer, X-Forwaded-For checkboxes under HTTP Header Logging.
   
4. Create a security policy for traffic of interest.
5. Under Profile Settings, call the configured URL Filtering Profile and select OK.
   
6. Commit the configuration.
7. Navigate to Monitor > Logs > URL filtering. Use the filter to select the source user.
   Note: The referrer field will list out the URLs visited by the end user. The individual log will look like this:
   
8. Under HTTP header, use the referrer field to get the actual URLs each user accessed.

owner: skumar1