Related Logs in Traffic Log - no URL-Filtering?

[cryptochrome]

Hi,

isn't the "Related Logs" field in the details of a traffic log entry supposed to list logs from other logging categories like URL-Filtering or Data-Filtering as well? I only seem to get other traffic logs in the related log field.

Example:

* outgoing web-browsing is allowed, logging is turned on

* URL-filtering is in place, logging is turned on (action: alert)

* User browses to www.wired.com, category "News" (I just made that up).

Result:

* I see the request in the URL-Filtering logs

* I see the request in traffic logs

BUT:

* I open the corresponding traffic log entry to see the details and look at the "related logs" field. Nothing from the URL-Filter shows up here. Even though it was logged.

It does work the other way around (looking at URL-Filter log entry details, related logs shows corresponding traffic log entries).

Is this a but? PanOS 5.02.

[gswcowboy]

Does it not show up as a 'threat' log?

Here's the URL log for session id 55307

General Session ID   55307 Threat/Content Type   url Action   alert Application   web-browsing Rule   test group Category   computer-and-internet-info Virtual System   vsys1 Device   001606002115 Threat/Content Name   ID   Severity   informational IP Protocol   tcp Log Action   Repeat Count   1 URL   www.speedtest.net/ Request Categorization Change Source Source User   amb\renato Source address   172.16.20.2 Source Port   54739 Source Zone   L3_Trust Inbound Interface   ethernet1/2 NAT Source IP   10.16.3.241 NAT Source Port   26212 Destination Destination User   Destination address   72.21.92.20 Destination Port   80 Destination Zone   L3_Untrust Outbound Interface   ethernet1/1 NAT Destination IP   72.21.92.20 NAT Destination Port   80

Time Generate Time   2013/05/28 11:57:51 Receive Time   2013/05/28 11:57:52 Misc Captive Portal   Proxy Transaction   Decrypted   Packet Capture   Direction   client-to-server

Related Logs (+/- 24 Hours) Receive Time Log Type Application Action Rule Bytes Packets Severity Category URL / Filename 05/28 11:57:52 threat url web-browsing alert test group informational computer-and-internet-info www.speedtest.net/ 05/28 11:58:39 traffic end web-browsing allow test group 10,271 20

Here's the traffic log for the same session ID

Session ID   55307 Type   end Action   allow Application   web-browsing Rule   test group Category   computer-and-internet-info Virtual System   vsys1 Device   001606002115 IP Protocol   tcp Log Action   Bytes   10,271 Bytes Received   8,546 Bytes Sent   1,725 Repeat Count   1 Packets   20 Packets Received   10 Packets Sent   10 Source Source User   amb\renato Source address   172.16.20.2 Source Country   172.16.0.0-172.31.255.255 Source Port   54739 Source Zone   L3_Trust Inbound Interface   ethernet1/2 NAT Source IP   10.16.3.241 NAT Source Port   26212 Destination Destination User   Destination address   72.21.92.20 Destination Country   US Destination Port   80 Destination Zone   L3_Untrust Outbound Interface   ethernet1/1 NAT Destination IP   72.21.92.20 NAT Destination Port   80

Time Generate Time   2013/05/28 11:58:40 Start Time   2013/05/28 11:57:52 Receive Time   2013/05/28 11:58:39 Elapsed Time (sec)   18 Misc Captive Portal   Proxy Transaction   Decrypted   Packet Capture   Client to Server   Server to Client

Related Logs (+/- 24 Hours) Receive Time Log Type Application Action Rule Bytes Packets Severity Category URL / Filename 05/28 11:57:52 threat url web-browsing alert test group informational computer-and-internet-info www.speedtest.net/ 05/28 11:58:39 traffic end web-browsing allow test group 10,271 20

[cryptochrome]

Thanks. That's strange. If I do a search on a specific session ID like you did, the related logs show up. If I randomly pick any other web-browsing traffic log, the related logs do not show.

[gswcowboy]

Searched traffic logs and found one where there was no correlating "URL" threat log. So I scoured the url logs and filtered by dst ip and src port equivalent to what was detected via the traffic log and sure enough, no URL log found .

[cryptochrome]

Not in my case. I definitely have corresponding URL logs that do not show up in related logs. 100%

[gswcowboy]

Perhaps a call into Support would be more feasible so we can dissect this further?     

[cryptochrome]

will do. thanks for your help!