Flags in Syslog

[Remo]

Hi all

Paloalto is able to forward logs to a syslog server. So far so good. In these logs there is a hex-value which indicates what was done with this session.

In the documentation ( https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/monitoring/syslog-field-descriptions ) there are these known flag values:

• 0x80000000 —session has a packet capture (PCAP)
• 0x02000000 —IPv6 session
• 0x01000000 —SSL session was decrypted (SSL Proxy)
• 0x00800000 —session was denied via URL filtering
• 0x00400000 —session has a NAT translation performed (NAT)
• 0x00200000 —user information for the session was captured through Captive Portal
• 0x00080000 —X-Forwarded-For value from a proxy is in the source user field
• 0x00040000 —log corresponds to a transaction within a http proxy session (Proxy Transaction)
• 0x00008000 —session is a container page access (Container Page)
• 0x00002000 —session has a temporary match on a rule for implicit application dependency handling. Available in PAN-OS 5.0.0 and above.
• 0x00000800 —symmetric return was used to forward traffic for this session

Now the question is: What do other values mean which are not in the documentation?

For example in one log we have 0x150001c:

          0001 0101 0000 0000 0000 0001 1100

          0001 0000 0000 0000 0000 0000 0000 --> Decrypted

          0000 0100 0000 0000 0000 0000 0000 --> NAT applied

... obviously this session was decrypted and has NAT applied...

          0000 0001 0000 0000 0000 0001 1100 --> what do these values mean?

Does someone know more about these flags?