Netflow - firewallEvent

cancel
Showing results for 
Search instead for 
Did you mean: 

Netflow - firewallEvent

L0 Member

Hi,

what does the content of the firewallEvent field mean? Is there a better documentation than this document?

-> https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/reports-and-logging/netflow-template...

 

Especially what is the difference between "Flow created" and "Flow deleted"?

Is "Flow created" a flow with a duration shorter than a defined timeout and "Flow deleted" a very short-lived flow?

 

"Flow updated" seems to be a long lasting flow exported in separate parts, but the document states:

"the session state changed from active to deny". I am unsure about that.

 

When would "Flow alerted" be generated? It never pops up in my collector software.

 

 

 

 

2 REPLIES 2

Cyber Elite
Cyber Elite

@evanskie,

think this would likely make more sense if it just called 'flow' what it trully is refering to, a session. I could be wrong on that though. 

If I'm right that would make it essentially be 

1 = Flow created

2 = Flow deleted

3 = Flow denied

4 = Flow alert

5 = Flow update

Would actually mean

1) Session Created

2) Session Deleted.    

3) Session Denied.

4)  ? If I would have to guess I would say this triggers if a DoS profile is tripped, I would have to test this out to be sure though.                       

5) Session switched from Active to Drop due to something like an applicaiton change. 

 

The document is included in all of the 7.1 administration guides and I would assume 8.0 as well, but no further description was provided in the 7.0 and 7.1 administration guides when I looked. 

Thanks for your reply.

 

From my understanding a unique flow is determined by the tuple SRC-Ip/SRC-Port and DST-Ip/DST-Port.

 

I analyzed the flow data in my environment (ELK-Stack) and there are only entries of unique flows which are tagged either with "Flow create" or "Flow deleted". So there must be an other explanation for that.

 

For "Flow update" I can see multiple entries for the same flow exported about every 15 minutes (long lasting SSH-Connections).

 

"Flow denied" is clear: this flow was dropped by the firewall.

 

Someone else some ideas?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!