PALO ALTO PAN OS 8.0

[Saad.ahmed]

Hello Team,
I am a SOC ANALYST , I wanted to know all the "Event name" that i can see on my SIEM. so i can make sure that i am seeing all the events. Please help. I want to make sure if any "Event Name" is missing.
Currently I am seeing these "Event Names"

Traffic Close

URL Filtering

Session Denied

Received conflicting ARP on interface indicating duplicate IP

System Informational

Client Configuration

FileType Detected

User Logout

URL Blocked

System Error

System Notice

User Login

Config installed

Daemon configuration load phase succeeded

Configuration Change Successful

Failed User Login

User connected to a server

unknown

PAN-DB miscellaneous information

PNG File Chunk Length Abnormal

Configuration Changed Submitted

Configuration synchronized with peer

HTTP SQL Injection Attempt

Suspicious DNS Query

HTTP SQL Injection Attempt

User Session Timed Out

HTTP Directory Traversal Vulnerability

Wordpress system.multicall XMLRPC Information Disclosure Vulnerability

OpenSSL TLS Malformed Heartbeat Request Found - Heartbleed

OpenSSL TLS Encrypted Heartbeat Information Disclosure Vulnerability - Heartbleed

Palo Alto PA Series Appliances Message

Microsoft Windows win.ini access attempt

HTTP Cross Site Scripting Attempt

WordPress Cuckootap Theme Arbitrary File Download Vulnerability

WordPress Revolution Slider File Upload Vulnerability

Unrecognized Vulnerability Exploit Threat Event

HTTP SQL Injection Attempt

HTTP SQL Injection Attempt

System Warning

Generic HTTP Cross Site Scripting Attempt

Generic HTTP Cross Site Scripting Attempt

Configuration Change Failed

Long Http Transfer Encoding Anomaly

Baidu_Sobar_4_9_4 Information Disclosure

Bash Remote Code Execution Vulnerability

Apache Struts ClassLoader Security Bypass Vulnerability

PeerCast HandshakeHTTP Function Buffer Overflow

Netscape iPlanet Search NS-Query-Pat Directory Traversal Vulnerability

Apache Struts2 Redirect/Action Method Remote Code Execution Vulnerability

IBM WebSphere Faultactor Cross-Site Scripting Vulnerability

RealNetworks Realplayer RecordClip Parameter Injection Remote Code Execution Vulnerability

Wordpress MailPoet Newsletters Unauthenticated File Upload Vulnerability

Jive Software Openfire Jabber Server Authentication Bypass

Microsoft Schannel Remote Code Execution Vulnerability

Generic HTTP Cross Site Scripting Attempt

HTTP Non-RFC Compliant Request

Microsoft Windows IIS Script Filename Wrong Parsing Remote Code Execution Vulnerability

Unrecognized Spyware Threat Event

Apache Struts Content-Type Remote Code Execution Vulnerability

WordPress Login BruteForce Attempt

[Remo]

Hi @Saad.ahmed

I honestly don't think someone will (or is able) to share a complete list of event names. But may I ask for what you need such a list? As a SOC analyst my interpretation is that you need to be alerted based on the severity of the events and of there is vulnerable software that is used kn your network you can override the alerts and priorize specific events. On https://threatvault.paloaltonetworks.com you can search for threat IDs. There are thousands of vulnerabilities a paloalto firewall is able to detect, so your list needs to be a little longer to be complete.

Regards,

Remo