IDPS firewall
| Workload location | Hardware |
| Audit log source | Palo Alto Firewall |
| Audited operations |
Log in to Web UI and show settings
| Fields in the log entry that contain audit information | ||
|---|---|---|
| Audit metadata | Audit field name | Value |
| User or service identity | message | A subset of the |
| Target (Fields and values that call the API) | message | For example, |
| Action (Fields containing the performed operation) | message | A subset of the |
| Event timestamp | time | For example, |
| Source of action | host | For example, |
| Outcome | Not applicable | Not applicable |
| Other fields | Not applicable | Not applicable |
Example log
{ "pri": "14", "time": "2022-11-22T12:03:55-08:00", "host": "10.251.72.101", "ident": "-", "pid": "-", "msgid": "-", "extradata": "-", "message": "012501009150,2022/11/22 12:03:54,audit,2561,gui-op,admin,\"<show><system><setting><multi-vsys/></setting></system></show>\",success", "_gdch_cluster": "root-admin", "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-6lgds", "_gdch_service_name": "panw_audit_logs" } Commit job changes
| Fields in the log entry that contain audit information | ||
|---|---|---|
| Audit metadata | Audit field name | Value |
| User or service identity | message | A subset of the |
| Target (Fields and values that call the API) | message | For example, |
| Action (Fields containing the performed operation) | message | A subset of the |
| Event timestamp | time | For example, |
| Source of action | host | For example, |
| Outcome | Not applicable | Not applicable |
| Other fields | Not applicable | Not applicable |
Example log
{ "pri": "14", "time": "2022-11-22T12:11:34-08:00", "host": "10.251.72.101", "ident": "-", "pid": "-", "msgid": "-", "extradata": "-", "message": "1,2022/11/22 12:11:33,012501009150,CONFIG,0,2561,2022/11/22 12:11:33,10.251.72.79,,commit,admin,Web,Submitted,,7168767370163388448,0x0,0,0,0,0,,zb-aa-fw01,0,,0,2022-11-22T12:11:34.635-08:00", "_gdch_cluster": "root-admin", "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-6lgds", "_gdch_service_name": "panw_audit_logs" }