¿Category = License Expired? Palo Alto 5200 series firewall

[ajcedenoc]

On a Palo Alto 5200 series firewall running PAN-OS 11.1, the THREAT log documentation says:

"

CATEGORY: For WildFire subtype, it is the verdict on the file and is either ‘malware’, ‘phishing’, ‘grayware’, or ‘benign’; For other subtypes, the value is ‘any’.

"

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/sysl...

I'm receiving logs for the WildFire subtype with a category of "license expired" or "any." Why is this happening?

In addition, I'm receiving logs for other threat subtypes, some with "Category = license expired" and the rest with "Category = any."

Does this mean the THREATS license has expired on the firewall?

[BPry]

@ajcedenoc,

Your wildfire subscription license has expired. Since these are usually all licensed co-termed on the device, it's possible/likely that you have multiple expired licenses. You can either look on the GUI or run 'request license info' to view the current status of your licenses.