---
title: "NGFW and GlobalProtect"
slug: "ngfw-and-globalprotect"
updated: 2026-01-15T09:59:28Z
published: 2026-01-15T09:59:28Z
canonical: "docs.hunters.ai/ngfw-and-globalprotect"
---
> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# NGFW and GlobalProtect
Self Service Ingestion
Connect this data source on your own, using the Hunters platform.
****TL;DR****
| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Traffic log | | | ✅ | ✅ | pan_firewall_traffic | CSV | S3 |
| Hip Match log | | | ✅ | | pan_firewall_hip | CSV | S3 |
| Threat log | ✅ | | ✅ | | pan_firewall_threat | CSV | S3 |
| System log | | | ✅ | | pan_firewall_system | CSV | S3 |
| GlobalProtect log | | | ✅ | ✅ | pan_firewall_globalprotect | CSV | S3 |
| Config log | | | | | pan_firewall_config | CSV | S3 |
| PAN Firewall URL filtering logs | ✅ | ✅ | ✅ | ✅ | pan_firewall_url_filtering_logs | Json | S3 |
| PAN Firewall Users | | ✅ | ✅ | ✅ | pan_firewall_users | csv-no-header | S3 |
---
## Overview
Palo Alto Networks is a leading cybersecurity company that provides a wide range of security solutions designed to protect networks, endpoints, and cloud environments. Known for its next-generation firewalls, Palo Alto Networks offers advanced threat prevention, traffic inspection, and secure access. Their product portfolio includes solutions for **cloud security, threat intelligence, and endpoint protection**, as well as **security operations** through their **Cortex** platform. With a focus on automation, machine learning, and AI, Palo Alto Networks helps organizations detect, prevent, and respond to sophisticated cyberattacks while ensuring compliance and minimizing risks across their infrastructure.
## Supported data types
****Traffic log****
**Table name**: `pan_firewall_traffic`
Traffic logs on Palo Alto Networks Firewalls record detailed information about the sessions processed by the firewall. These logs are invaluable for security analysis, troubleshooting network issues, and ensuring compliance with organizational policies.
[More details](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields.html)
## Send data to Hunters
**📘Note**
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
### Prerequisites
⚠️ Known timezone issues
Palo Alto Networks firewall does not include the timezone as part of the timestamp in the log by design. For example, if your Firewall is set to 8:00:00 EST, then the time in the syslog will be 8:00:00 (without the EST timezone). By default, Hunters treats timezone-free timestamps as they were in UTC.
In order to overcome this issue and let Hunters infer the correct timestamp, you are required to change the time settings of the device itself. As answered in PAN LiveCommunity this change will not affect active sessions. The time zone is used in display of information and in log events generated.
**Note:** If you are forwarding logs from a few devices, you are required to perform this change on all of them.
- Set up a syslog server that will capture logs coming from PAN devices.
- Set a unique TCP port for each data type you're interested in. For example if traffic, threat and system logs are about to be shipped, verify your syslog server expects to receive them from ports: 5140, 5141, 5142 and transmit them to different folders on S3.
### 1. Exporting Logs from Appliances to S3
These instructions assume that your firewall has a basic configuration applied and you can connect to it.
****Step 1 - Configure management logging****
1. Log into your firewalls management interface.
2. Click on the **Devices** tab, then on the left hand side menu click **Server Properties** > **Syslog**. A Syslog Server Profile dialog box will appear.
3. You can either add a new configuration or modify an existing one to add the new syslog destination as below:
1. Type a configuration name in the name field.
2. Click **Add**. 
3. Enter the syslog server name in the name field.
4. Enter the syslog server IP address or FQDN into the **Syslog Server** field.
5. Enter the transport type in the **Transport** field (UDP, TCP, TLS).
6. Enter the proper port for your syslog receiver.
7. At the format field, enter IETF format if you are using the fluentd configuration snippet below.
8. Enter the proper facility. The default of LOG_USER is the default.
9. Click on the **OK** button to complete the configuration.
4. To utilize the new syslog profile or one that you currently have, click on **Log Settings** and add the profile that should be used. Click the **Add** button to add the profile. 
1. This is an example of how to configure the firewall to send system related events to your new syslog destination. Once the configuration is complete click **OK**. 
1. Create another profile like the one above for HIP Match. 
1. Click on **Objects** > **Log Forwarding**, and then click **Add**. 
1. A Log Forwarding Profile for Threat Based Logs. Once complete click **OK**. 
1. A Log Forwarding Profile for Traffic Based Logs. Once complete click on **OK**. 
1. Once this is complete, please commit the configuration to your firewall.
****Step 2 - Fluentd Source Configuration****
Please make sure to set the port value in the configuration below.
```plaintext
@type syslog
port {{Set to a valid port value}}
bind 0.0.0.0
@log_level trace
frame_type octet_count
@type syslog
message_format rfc5424
rfc5424_time_format %FT%T%:z
with_priority true
@type single_value
tag default_syslog
```
It is required to set the parse section as detailed above. We have configured fluentd to expect RFC 5424 formatted messages with the required time format and the priority set.
### 2. Bringing logs from S3 to Hunters
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
## Expected format
Hunters expects PAN log files to be csv-formatted. The following is an example of a typical traffic log:
```plaintext
1,2020/01/25 15:28:37,1234C543298CA52,TRAFFIC,start,2305,2020/01/25 15:28:37,
10.120.94.200,172.217.3.121,10.104.12.123,172.217.3.121,in-to-out_internet,
xxx\yyy,,quic,vsys1,Trust,Untrust,ethernet1/2,ethernet1/1,org-syslog-log-fw,
2020/01/25 15:28:37,2061061,1,54388,443,19179,443,0x400000,udp,allow,1392,1392,
0,1,2020/01/25 15:28:40,0,any,0,8652125730,0x0,10.0.0.0-10.255.255.255,United States,
0,1,0,n/a,0,0,0,0,,aws-pa300-fw2,from-policy,,,0,,0,,N/A,0,0,0,0,2ecd13fd-4b56
-40af-93e1-2658e29ac007,0,0,,,,,,,
```
The following is the list of the headers alligned with this sample:
```plaintext
future_use_1,receive_time,firewall_serial_number,type,threat_content_type,future_use_2,generated_time,virtual_system,event_id,stage,authentication_method,tunnel_type,source_user,source_region,machine_name,public_ip,public_ip_v6,private_ip,private_ip_v6,host_id,machine_serial_number,client_version,client_os,client_os_version,repeat_count,reason,error,description,status,location,login_duration,connect_method,error_code,portal,sequence_number,action_flags
```
****Hip Match log****
**Table name**: `pan_firewall_hip`
Palo Alto Networks Firewall HIP (Host Information Profile) Match logs are a specific category of logs generated by Palo Alto Networks' firewalls that provide detailed insights into the compliance status of devices connecting to the network against predefined host information profiles. HIP profiles are used to collect information about the security status of a device, such as the presence of antivirus software, disk encryption status, patch levels, and more. When a device attempts to connect to the network, the firewall evaluates the device against these profiles to determine if it meets the organization's security requirements.
[More details](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/hip-match-log-fields.html)
## Send data to Hunters
**📘Note**
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
### Prerequisites
⚠️ Known timezone issues
Palo Alto Networks firewall does not include the timezone as part of the timestamp in the log by design. For example, if your Firewall is set to 8:00:00 EST, then the time in the syslog will be 8:00:00 (without the EST timezone). By default, Hunters treats timezone-free timestamps as they were in UTC.
In order to overcome this issue and let Hunters infer the correct timestamp, you are required to change the time settings of the device itself. As answered in PAN LiveCommunity this change will not affect active sessions. The time zone is used in display of information and in log events generated.
**Note:** If you are forwarding logs from a few devices, you are required to perform this change on all of them.
- Set up a syslog server that will capture logs coming from PAN devices.
- Set a unique TCP port for each data type you're interested in. For example if traffic, threat and system logs are about to be shipped, verify your syslog server expects to receive them from ports: 5140, 5141, 5142 and transmit them to different folders on S3.
### 1. Exporting Logs from Appliances to S3
These instructions assume that your firewall has a basic configuration applied and you can connect to it.
****Step 1 - Configure management logging****
1. Log into your firewalls management interface.
2. Click on the **Devices** tab, then on the left hand side menu click **Server Properties** > **Syslog**. A Syslog Server Profile dialog box will appear.
3. You can either add a new configuration or modify an existing one to add the new syslog destination as below:
1. Type a configuration name in the name field.
2. Click **Add**. 
3. Enter the syslog server name in the name field.
4. Enter the syslog server IP address or FQDN into the **Syslog Server** field.
5. Enter the transport type in the **Transport** field (UDP, TCP, TLS).
6. Enter the proper port for your syslog receiver.
7. At the format field, enter IETF format if you are using the fluentd configuration snippet below.
8. Enter the proper facility. The default of LOG_USER is the default.
9. Click on the **OK** button to complete the configuration.
4. To utilize the new syslog profile or one that you currently have, click on **Log Settings** and add the profile that should be used. Click the **Add** button to add the profile. 
1. This is an example of how to configure the firewall to send system related events to your new syslog destination. Once the configuration is complete click **OK**. 
1. Create another profile like the one above for HIP Match. 
1. Click on **Objects** > **Log Forwarding**, and then click **Add**. 
1. A Log Forwarding Profile for Threat Based Logs. Once complete click **OK**. 
1. A Log Forwarding Profile for Traffic Based Logs. Once complete click on **OK**. 
1. Once this is complete, please commit the configuration to your firewall.
****Step 2 - Fluentd Source Configuration****
Please make sure to set the port value in the configuration below.
```plaintext
@type syslog
port {{Set to a valid port value}}
bind 0.0.0.0
@log_level trace
frame_type octet_count
@type syslog
message_format rfc5424
rfc5424_time_format %FT%T%:z
with_priority true
@type single_value
tag default_syslog
```
It is required to set the parse section as detailed above. We have configured fluentd to expect RFC 5424 formatted messages with the required time format and the priority set.
### 2. Bringing logs from S3 to Hunters
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
## Expected format
Hunters expects PAN log files to be csv-formatted. The following is an example of a typical traffic log:
```plaintext
1,2020/01/25 15:28:37,1234C543298CA52,TRAFFIC,start,2305,2020/01/25 15:28:37,
10.120.94.200,172.217.3.121,10.104.12.123,172.217.3.121,in-to-out_internet,
xxx\yyy,,quic,vsys1,Trust,Untrust,ethernet1/2,ethernet1/1,org-syslog-log-fw,
2020/01/25 15:28:37,2061061,1,54388,443,19179,443,0x400000,udp,allow,1392,1392,
0,1,2020/01/25 15:28:40,0,any,0,8652125730,0x0,10.0.0.0-10.255.255.255,United States,
0,1,0,n/a,0,0,0,0,,aws-pa300-fw2,from-policy,,,0,,0,,N/A,0,0,0,0,2ecd13fd-4b56
-40af-93e1-2658e29ac007,0,0,,,,,,,
```
The following is the list of the headers alligned with this sample:
```plaintext
future_use_1,receive_time,firewall_serial_number,type,threat_content_type,future_use_2,generated_time,virtual_system,event_id,stage,authentication_method,tunnel_type,source_user,source_region,machine_name,public_ip,public_ip_v6,private_ip,private_ip_v6,host_id,machine_serial_number,client_version,client_os,client_os_version,repeat_count,reason,error,description,status,location,login_duration,connect_method,error_code,portal,sequence_number,action_flags
```
****Threat log****
**Table name**: `pan_firewall_threat`
These logs are specifically designed to provide detailed information about potential security threats detected by the firewall, helping organizations to quickly identify, analyze, and respond to various types of malicious activities and vulnerabilities in their network traffic.
[More details](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields.html)
## Send data to Hunters
**📘Note**
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
### Prerequisites
⚠️ Known timezone issues
Palo Alto Networks firewall does not include the timezone as part of the timestamp in the log by design. For example, if your Firewall is set to 8:00:00 EST, then the time in the syslog will be 8:00:00 (without the EST timezone). By default, Hunters treats timezone-free timestamps as they were in UTC.
In order to overcome this issue and let Hunters infer the correct timestamp, you are required to change the time settings of the device itself. As answered in PAN LiveCommunity this change will not affect active sessions. The time zone is used in display of information and in log events generated.
**Note:** If you are forwarding logs from a few devices, you are required to perform this change on all of them.
- Set up a syslog server that will capture logs coming from PAN devices.
- Set a unique TCP port for each data type you're interested in. For example if traffic, threat and system logs are about to be shipped, verify your syslog server expects to receive them from ports: 5140, 5141, 5142 and transmit them to different folders on S3.
### 1. Exporting Logs from Appliances to S3
These instructions assume that your firewall has a basic configuration applied and you can connect to it.
****Step 1 - Configure management logging****
1. Log into your firewalls management interface.
2. Click on the **Devices** tab, then on the left hand side menu click **Server Properties** > **Syslog**. A Syslog Server Profile dialog box will appear.
3. You can either add a new configuration or modify an existing one to add the new syslog destination as below:
1. Type a configuration name in the name field.
2. Click **Add**. 
3. Enter the syslog server name in the name field.
4. Enter the syslog server IP address or FQDN into the **Syslog Server** field.
5. Enter the transport type in the **Transport** field (UDP, TCP, TLS).
6. Enter the proper port for your syslog receiver.
7. At the format field, enter IETF format if you are using the fluentd configuration snippet below.
8. Enter the proper facility. The default of LOG_USER is the default.
9. Click on the **OK** button to complete the configuration.
4. To utilize the new syslog profile or one that you currently have, click on **Log Settings** and add the profile that should be used. Click the **Add** button to add the profile. 
1. This is an example of how to configure the firewall to send system related events to your new syslog destination. Once the configuration is complete click **OK**. 
1. Create another profile like the one above for HIP Match. 
1. Click on **Objects** > **Log Forwarding**, and then click **Add**. 
1. A Log Forwarding Profile for Threat Based Logs. Once complete click **OK**. 
1. A Log Forwarding Profile for Traffic Based Logs. Once complete click on **OK**. 
1. Once this is complete, please commit the configuration to your firewall.
****Step 2 - Fluentd Source Configuration****
Please make sure to set the port value in the configuration below.
```plaintext
@type syslog
port {{Set to a valid port value}}
bind 0.0.0.0
@log_level trace
frame_type octet_count
@type syslog
message_format rfc5424
rfc5424_time_format %FT%T%:z
with_priority true
@type single_value
tag default_syslog
```
It is required to set the parse section as detailed above. We have configured fluentd to expect RFC 5424 formatted messages with the required time format and the priority set.
### 2. Bringing logs from S3 to Hunters
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
## Expected format
Hunters expects PAN log files to be csv-formatted. The following is an example of a typical traffic log:
```plaintext
1,2020/01/25 15:28:37,1234C543298CA52,TRAFFIC,start,2305,2020/01/25 15:28:37,
10.120.94.200,172.217.3.121,10.104.12.123,172.217.3.121,in-to-out_internet,
xxx\yyy,,quic,vsys1,Trust,Untrust,ethernet1/2,ethernet1/1,org-syslog-log-fw,
2020/01/25 15:28:37,2061061,1,54388,443,19179,443,0x400000,udp,allow,1392,1392,
0,1,2020/01/25 15:28:40,0,any,0,8652125730,0x0,10.0.0.0-10.255.255.255,United States,
0,1,0,n/a,0,0,0,0,,aws-pa300-fw2,from-policy,,,0,,0,,N/A,0,0,0,0,2ecd13fd-4b56
-40af-93e1-2658e29ac007,0,0,,,,,,,
```
The following is the list of the headers alligned with this sample:
```plaintext
future_use_1,receive_time,firewall_serial_number,type,threat_content_type,future_use_2,generated_time,virtual_system,event_id,stage,authentication_method,tunnel_type,source_user,source_region,machine_name,public_ip,public_ip_v6,private_ip,private_ip_v6,host_id,machine_serial_number,client_version,client_os,client_os_version,repeat_count,reason,error,description,status,location,login_duration,connect_method,error_code,portal,sequence_number,action_flags
```
****System log****
**Table name**: `pan_firewall_system`
These logs are essential for monitoring system activities, identifying issues, and ensuring the firewall is functioning optimally to protect the network against threats. The system logs capture events related to the firewall's internal processes, including configuration changes, system errors, administrative access, and other system-related activities.
[More details](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/system-log-fields.html)
## Send data to Hunters
**📘Note**
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
### Prerequisites
⚠️ Known timezone issues
Palo Alto Networks firewall does not include the timezone as part of the timestamp in the log by design. For example, if your Firewall is set to 8:00:00 EST, then the time in the syslog will be 8:00:00 (without the EST timezone). By default, Hunters treats timezone-free timestamps as they were in UTC.
In order to overcome this issue and let Hunters infer the correct timestamp, you are required to change the time settings of the device itself. As answered in PAN LiveCommunity this change will not affect active sessions. The time zone is used in display of information and in log events generated.
**Note:** If you are forwarding logs from a few devices, you are required to perform this change on all of them.
- Set up a syslog server that will capture logs coming from PAN devices.
- Set a unique TCP port for each data type you're interested in. For example if traffic, threat and system logs are about to be shipped, verify your syslog server expects to receive them from ports: 5140, 5141, 5142 and transmit them to different folders on S3.
### 1. Exporting Logs from Appliances to S3
These instructions assume that your firewall has a basic configuration applied and you can connect to it.
****Step 1 - Configure management logging****
1. Log into your firewalls management interface.
2. Click on the **Devices** tab, then on the left hand side menu click **Server Properties** > **Syslog**. A Syslog Server Profile dialog box will appear.
3. You can either add a new configuration or modify an existing one to add the new syslog destination as below:
1. Type a configuration name in the name field.
2. Click **Add**. 
3. Enter the syslog server name in the name field.
4. Enter the syslog server IP address or FQDN into the **Syslog Server** field.
5. Enter the transport type in the **Transport** field (UDP, TCP, TLS).
6. Enter the proper port for your syslog receiver.
7. At the format field, enter IETF format if you are using the fluentd configuration snippet below.
8. Enter the proper facility. The default of LOG_USER is the default.
9. Click on the **OK** button to complete the configuration.
4. To utilize the new syslog profile or one that you currently have, click on **Log Settings** and add the profile that should be used. Click the **Add** button to add the profile. 
1. This is an example of how to configure the firewall to send system related events to your new syslog destination. Once the configuration is complete click **OK**. 
1. Create another profile like the one above for HIP Match. 
1. Click on **Objects** > **Log Forwarding**, and then click **Add**. 
1. A Log Forwarding Profile for Threat Based Logs. Once complete click **OK**. 
1. A Log Forwarding Profile for Traffic Based Logs. Once complete click on **OK**. 
1. Once this is complete, please commit the configuration to your firewall.
****Step 2 - Fluentd Source Configuration****
Please make sure to set the port value in the configuration below.
```plaintext
@type syslog
port {{Set to a valid port value}}
bind 0.0.0.0
@log_level trace
frame_type octet_count
@type syslog
message_format rfc5424
rfc5424_time_format %FT%T%:z
with_priority true
@type single_value
tag default_syslog
```
It is required to set the parse section as detailed above. We have configured fluentd to expect RFC 5424 formatted messages with the required time format and the priority set.
### 2. Bringing logs from S3 to Hunters
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
## Expected format
Hunters expects PAN log files to be csv-formatted. The following is an example of a typical traffic log:
```plaintext
1,2020/01/25 15:28:37,1234C543298CA52,TRAFFIC,start,2305,2020/01/25 15:28:37,
10.120.94.200,172.217.3.121,10.104.12.123,172.217.3.121,in-to-out_internet,
xxx\yyy,,quic,vsys1,Trust,Untrust,ethernet1/2,ethernet1/1,org-syslog-log-fw,
2020/01/25 15:28:37,2061061,1,54388,443,19179,443,0x400000,udp,allow,1392,1392,
0,1,2020/01/25 15:28:40,0,any,0,8652125730,0x0,10.0.0.0-10.255.255.255,United States,
0,1,0,n/a,0,0,0,0,,aws-pa300-fw2,from-policy,,,0,,0,,N/A,0,0,0,0,2ecd13fd-4b56
-40af-93e1-2658e29ac007,0,0,,,,,,,
```
The following is the list of the headers alligned with this sample:
```plaintext
future_use_1,receive_time,firewall_serial_number,type,threat_content_type,future_use_2,generated_time,virtual_system,event_id,stage,authentication_method,tunnel_type,source_user,source_region,machine_name,public_ip,public_ip_v6,private_ip,private_ip_v6,host_id,machine_serial_number,client_version,client_os,client_os_version,repeat_count,reason,error,description,status,location,login_duration,connect_method,error_code,portal,sequence_number,action_flags
```
****GlobalProtect log****
**Table name**: `pan_firewall_globalprotect`
GlobalProtect logs are specifically related to the GlobalProtect VPN service, which provides secure remote access to an organization's network. These logs are crucial for monitoring, troubleshooting, and ensuring the security and integrity of remote access connections.
[More details](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/globalprotect-log-fields/globalprotect-log-fields-for-pan-os-913-and-later-releases.html#id5795bd71-1dc5-4f82-872d-a9ba6cb7cedf)
## Send data to Hunters
**📘Note**
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
### Prerequisites
⚠️ Known timezone issues
Palo Alto Networks firewall does not include the timezone as part of the timestamp in the log by design. For example, if your Firewall is set to 8:00:00 EST, then the time in the syslog will be 8:00:00 (without the EST timezone). By default, Hunters treats timezone-free timestamps as they were in UTC.
In order to overcome this issue and let Hunters infer the correct timestamp, you are required to change the time settings of the device itself. As answered in PAN LiveCommunity this change will not affect active sessions. The time zone is used in display of information and in log events generated.
**Note:** If you are forwarding logs from a few devices, you are required to perform this change on all of them.
- Set up a syslog server that will capture logs coming from PAN devices.
- Set a unique TCP port for each data type you're interested in. For example if traffic, threat and system logs are about to be shipped, verify your syslog server expects to receive them from ports: 5140, 5141, 5142 and transmit them to different folders on S3.
### 1. Exporting Logs from Appliances to S3
These instructions assume that your firewall has a basic configuration applied and you can connect to it.
****Step 1 - Configure management logging****
1. Log into your firewalls management interface.
2. Click on the **Devices** tab, then on the left hand side menu click **Server Properties** > **Syslog**. A Syslog Server Profile dialog box will appear.
3. You can either add a new configuration or modify an existing one to add the new syslog destination as below:
1. Type a configuration name in the name field.
2. Click **Add**. 
3. Enter the syslog server name in the name field.
4. Enter the syslog server IP address or FQDN into the **Syslog Server** field.
5. Enter the transport type in the **Transport** field (UDP, TCP, TLS).
6. Enter the proper port for your syslog receiver.
7. At the format field, enter IETF format if you are using the fluentd configuration snippet below.
8. Enter the proper facility. The default of LOG_USER is the default.
9. Click on the **OK** button to complete the configuration.
4. To utilize the new syslog profile or one that you currently have, click on **Log Settings** and add the profile that should be used. Click the **Add** button to add the profile. 
1. This is an example of how to configure the firewall to send system related events to your new syslog destination. Once the configuration is complete click **OK**. 
1. Create another profile like the one above for HIP Match. 
1. Click on **Objects** > **Log Forwarding**, and then click **Add**. 
1. A Log Forwarding Profile for Threat Based Logs. Once complete click **OK**. 
1. A Log Forwarding Profile for Traffic Based Logs. Once complete click on **OK**. 
1. Once this is complete, please commit the configuration to your firewall.
****Step 2 - Fluentd Source Configuration****
Please make sure to set the port value in the configuration below.
```plaintext
@type syslog
port {{Set to a valid port value}}
bind 0.0.0.0
@log_level trace
frame_type octet_count
@type syslog
message_format rfc5424
rfc5424_time_format %FT%T%:z
with_priority true
@type single_value
tag default_syslog
```
It is required to set the parse section as detailed above. We have configured fluentd to expect RFC 5424 formatted messages with the required time format and the priority set.
### 2. Bringing logs from S3 to Hunters
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
## Expected format
Hunters expects PAN log files to be csv-formatted. The following is an example of a typical traffic log:
```plaintext
1,2020/01/25 15:28:37,1234C543298CA52,TRAFFIC,start,2305,2020/01/25 15:28:37,
10.120.94.200,172.217.3.121,10.104.12.123,172.217.3.121,in-to-out_internet,
xxx\yyy,,quic,vsys1,Trust,Untrust,ethernet1/2,ethernet1/1,org-syslog-log-fw,
2020/01/25 15:28:37,2061061,1,54388,443,19179,443,0x400000,udp,allow,1392,1392,
0,1,2020/01/25 15:28:40,0,any,0,8652125730,0x0,10.0.0.0-10.255.255.255,United States,
0,1,0,n/a,0,0,0,0,,aws-pa300-fw2,from-policy,,,0,,0,,N/A,0,0,0,0,2ecd13fd-4b56
-40af-93e1-2658e29ac007,0,0,,,,,,,
```
The following is the list of the headers alligned with this sample:
```plaintext
future_use_1,receive_time,firewall_serial_number,type,threat_content_type,future_use_2,generated_time,virtual_system,event_id,stage,authentication_method,tunnel_type,source_user,source_region,machine_name,public_ip,public_ip_v6,private_ip,private_ip_v6,host_id,machine_serial_number,client_version,client_os,client_os_version,repeat_count,reason,error,description,status,location,login_duration,connect_method,error_code,portal,sequence_number,action_flags
```
****Config log****
**Table name**: `pan_firewall_config`
Config logs record all changes made to the firewall's configuration settings. Whenever an administrator makes a change via the web interface, CLI, or API, the action is logged. This includes changes to security policies, network configurations, device settings, and more.
[More details](https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/config-log-fields.html)
## Send data to Hunters
**📘Note**
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
### Prerequisites
⚠️ Known timezone issues
Palo Alto Networks firewall does not include the timezone as part of the timestamp in the log by design. For example, if your Firewall is set to 8:00:00 EST, then the time in the syslog will be 8:00:00 (without the EST timezone). By default, Hunters treats timezone-free timestamps as they were in UTC.
In order to overcome this issue and let Hunters infer the correct timestamp, you are required to change the time settings of the device itself. As answered in PAN LiveCommunity this change will not affect active sessions. The time zone is used in display of information and in log events generated.
**Note:** If you are forwarding logs from a few devices, you are required to perform this change on all of them.
- Set up a syslog server that will capture logs coming from PAN devices.
- Set a unique TCP port for each data type you're interested in. For example if traffic, threat and system logs are about to be shipped, verify your syslog server expects to receive them from ports: 5140, 5141, 5142 and transmit them to different folders on S3.
### 1. Exporting Logs from Appliances to S3
These instructions assume that your firewall has a basic configuration applied and you can connect to it.
****Step 1 - Configure management logging****
1. Log into your firewalls management interface.
2. Click on the **Devices** tab, then on the left hand side menu click **Server Properties** > **Syslog**. A Syslog Server Profile dialog box will appear.
3. You can either add a new configuration or modify an existing one to add the new syslog destination as below:
1. Type a configuration name in the name field.
2. Click **Add**. 
3. Enter the syslog server name in the name field.
4. Enter the syslog server IP address or FQDN into the **Syslog Server** field.
5. Enter the transport type in the **Transport** field (UDP, TCP, TLS).
6. Enter the proper port for your syslog receiver.
7. At the format field, enter IETF format if you are using the fluentd configuration snippet below.
8. Enter the proper facility. The default of LOG_USER is the default.
9. Click on the **OK** button to complete the configuration.
4. To utilize the new syslog profile or one that you currently have, click on **Log Settings** and add the profile that should be used. Click the **Add** button to add the profile. 
1. This is an example of how to configure the firewall to send system related events to your new syslog destination. Once the configuration is complete click **OK**. 
1. Create another profile like the one above for HIP Match. 
1. Click on **Objects** > **Log Forwarding**, and then click **Add**. 
1. A Log Forwarding Profile for Threat Based Logs. Once complete click **OK**. 
1. A Log Forwarding Profile for Traffic Based Logs. Once complete click on **OK**. 
1. Once this is complete, please commit the configuration to your firewall.
****Step 2 - Fluentd Source Configuration****
Please make sure to set the port value in the configuration below.
```plaintext
@type syslog
port {{Set to a valid port value}}
bind 0.0.0.0
@log_level trace
frame_type octet_count
@type syslog
message_format rfc5424
rfc5424_time_format %FT%T%:z
with_priority true
@type single_value
tag default_syslog
```
It is required to set the parse section as detailed above. We have configured fluentd to expect RFC 5424 formatted messages with the required time format and the priority set.
### 2. Bringing logs from S3 to Hunters
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
## Expected format
Hunters expects PAN log files to be csv-formatted. The following is an example of a typical traffic log:
```plaintext
1,2020/01/25 15:28:37,1234C543298CA52,TRAFFIC,start,2305,2020/01/25 15:28:37,
10.120.94.200,172.217.3.121,10.104.12.123,172.217.3.121,in-to-out_internet,
xxx\yyy,,quic,vsys1,Trust,Untrust,ethernet1/2,ethernet1/1,org-syslog-log-fw,
2020/01/25 15:28:37,2061061,1,54388,443,19179,443,0x400000,udp,allow,1392,1392,
0,1,2020/01/25 15:28:40,0,any,0,8652125730,0x0,10.0.0.0-10.255.255.255,United States,
0,1,0,n/a,0,0,0,0,,aws-pa300-fw2,from-policy,,,0,,0,,N/A,0,0,0,0,2ecd13fd-4b56
-40af-93e1-2658e29ac007,0,0,,,,,,,
```
The following is the list of the headers alligned with this sample:
```plaintext
future_use_1,receive_time,firewall_serial_number,type,threat_content_type,future_use_2,generated_time,virtual_system,event_id,stage,authentication_method,tunnel_type,source_user,source_region,machine_name,public_ip,public_ip_v6,private_ip,private_ip_v6,host_id,machine_serial_number,client_version,client_os,client_os_version,repeat_count,reason,error,description,status,location,login_duration,connect_method,error_code,portal,sequence_number,action_flags
```
****PAN Firewall URL filtering logs****
**Table name**: `pan_firewall_url_filtering_logs`
Palo Alto Networks Next-Generation Firewalls are designed to provide comprehensive, identity-aware, application-aware protection across enterprise networks. The product combines deep packet inspection, user identification, advanced threat prevention, and cloud-delivered intelligence to give organizations strong control over how data, users, and applications move through their environment. By classifying traffic based on applications rather than ports, and by tying activity to users instead of IP addresses, the platform delivers visibility and security that traditional firewalls cannot match.
One of the important capabilities of the PAN firewall is its ability to analyze and control web activity through URL Filtering. As users browse the internet, the firewall evaluates each request, classifies the destination based on category and risk, and enforces policies that determine whether the connection should be allowed, blocked, or challenged. Every one of these decisions generates detailed URL Filtering logs, which capture information about the user, the requested site, the category assigned, the action taken, and any associated threat indicators.
Integrating these URL Filtering logs into a security platform or SIEM allows organizations to turn the firewall’s web-traffic intelligence into a powerful source of detection and investigation data. Once ingested, the logs can be used to identify risky browsing behavior, discover attempts to access malicious or prohibited sites, correlate web activity with endpoint or identity alerts, and support compliance monitoring. This combination of product capability and log insight offers a richer, more contextual view of how users interact with the web and enables security teams to respond more effectively to emerging threats.
### Bringing logs from S3 to Hunters
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
## Expected format
Hunters expects PAN-url-filtering log files to be Json or compressed-snappy by Strata shipper (containing json files)
The following is an example of a typical traffic log:
```json
{
"TimeReceived": "2025-01-01T12:00:00.000000Z",
"DeviceSN": "000000000000",
"LogType": "THREAT",
"Subtype": "url",
"ConfigVersion": "11.1",
"TimeGenerated": "2025-01-01T12:00:00.000000Z",
"SourceAddress": "1.1.1.1",
"DestinationAddress": "1.1.1.1",
"NATSource": "123.123.1.1",
"NATDestination": "1.1.1.1",
"Rule": "Permit Guest WLAN to Internet",
"SourceUser": null,
"DestinationUser": null,
"Application": "dns-over-https",
"VirtualLocation": "abcd123",
"FromZone": "DMZ Local-Internet",
"ToZone": "OUTSIDE",
"InboundInterface": "aaaa111111.100",
"OutboundInterface": "ae2",
"LogSetting": "MSS-abcd123-BE-SH",
"SessionID": 100000,
"RepeatCount": 1,
"SourcePort": 50000,
"DestinationPort": 443,
"NATSourcePort": 10000,
"NATDestinationPort": 443,
"Protocol": "tcp",
"Action": "block-url",
"URL": "example.com/",
"URLCategory": "encrypted-dns",
"VendorSeverity": "Informational",
"DirectionOfAttack": "client to server",
"SequenceNo": 1000000000000000000,
"SourceLocation": "12.0.0.0-10.123.123.255",
"DestinationLocation": "US",
"ContentType": null,
"PacketID": 0,
"URLCounter": 0,
"UserAgent": null,
"X-Forwarded-For": null,
"Referer": null,
"DGHierarchyLevel1": 100,
"DGHierarchyLevel2": 200,
"DGHierarchyLevel3": 0,
"DGHierarchyLevel4": 0,
"VirtualSystemName": "",
"DeviceName": "FW-DEVICE-01",
"SourceUUID": null,
"DestinationUUID": null,
"HTTPMethod": "unknown",
"IMSI": 0,
"IMEI": null,
"ParentSessionID": 0,
"ParentStarttime": "1970-01-01T00:00:00.000000Z",
"Tunnel": "N/A",
"InlineMLVerdict": "unknown",
"ContentVersion": "0",
"SigFlags": 0,
"HTTPHeaders": null,
"URLCategoryList": "encrypted-dns,computer-and-internet-info,low-risk",
"RuleUUID": "00000000-0000-0000-0000-000000000000",
"HTTP2Connection": 0,
"DynamicUserGroupName": null,
"X-Forwarded-ForIP": null,
"SourceDeviceCategory": null,
"SourceDeviceProfile": null,
"SourceDeviceModel": null,
"SourceDeviceVendor": null,
"SourceDeviceOSFamily": null,
"SourceDeviceOSVersion": null,
"SourceDeviceHost": null,
"SourceDeviceMac": null,
"DestinationDeviceCategory": null,
"DestinationDeviceProfile": null,
"DestinationDeviceModel": null,
"DestinationDeviceVendor": null,
"DestinationDeviceOSFamily": null,
"DestinationDeviceOSVersion": null,
"DestinationDeviceHost": null,
"DestinationDeviceMac": null,
"ContainerID": null,
"ContainerNameSpace": null,
"ContainerName": null,
"SourceEDL": null,
"DestinationEDL": null,
"HostID": null,
"EndpointSerialNumber": null,
"SourceDynamicAddressGroup": null,
"DestinationDynamicAddressGroup": null,
"TimeGeneratedHighResolution": "2025-01-01T12:00:00.000000Z",
"NSSAINetworkSliceType": null
}
```
[More about filtering URL logs](https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/view-and-manage-logs/log-types-and-severity-levels/url-filtering-logs)
[More about Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering)
****PAN Firewall UserID logs****
**Table name**: `pan_firewall_users`
Palo Alto Networks Next-Generation Firewalls provide deep visibility into user activity by integrating identity awareness directly into network security controls. Through features such as User-ID, the firewall maps IP addresses to individual users and groups by leveraging directory services, authentication logs, and endpoint context. This capability allows security policies and monitoring to be based on *who* the user is, rather than just *where* the traffic originates, enabling more precise and meaningful security enforcement.
The **pan_firewall_users** table represents the user identity data learned and maintained by the firewall. It captures information about users, their associated IP addresses, authentication sources, domains, and group memberships, as well as timestamps that reflect when these associations were observed or updated. By continuously correlating network activity with user identity, the firewall builds a dynamic picture of how users connect to and move across the network.
When ingested into a security analytics platform or Hunters SIEM, the data in the **pan_firewall_users** table becomes a foundational enrichment layer for investigations and detections. It allows analysts to tie firewall traffic, threat, and URL filtering logs back to specific users, support user-centric threat hunting, and investigate incidents with greater context. This user-level visibility also supports auditing and compliance use cases, helping organizations understand access patterns, validate policy enforcement, and respond quickly to suspicious or unauthorized activity.
###
### Bringing logs from S3 to Hunters
Onboarding this data source requires the help of Hunters Support. Once you've completed the setup stages, contact Hunters Support using [this](https://cyberhunter.atlassian.net/servicedesk/customer/portal/1/group/5/create/34) form.
## Expected format
Hunters expects PAN firewall users log files to be **csv-no-header** format.
The following is an example of a typical PAN firewall UserID Logs:
```plaintext
1,2025/12/07 09:06:18,1234503603,USERID,login,1234,2025/12/07 09:06:18,abccd1,10.123.12.4,abmac\12newrelic,awwabc01,0,1,12300,0,0,agent,,12345572937589,0x0,12,0,0,0,,hb-example-abc5410-ab1,1,,2025/12/07 09:06:13,1,0x12300000,abmac\12newrelic,,2025-12-07T09:06:18.840-08:00
```
[More about Palo Alto Firewall UserID Logs](https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/user-id-log-fields)
To achieve this result, be sure to set the PAN log format to non-customized and configure the syslog forwarder so that it saves the logs exactly as received.