Palo Alto PAN-OS
Firewalls and network logs — Palo Alto Networks
What is this product?
A firewall that inspects network traffic and allows or denies it by pre-written rules, logging for every attempt its direction, source and destination addresses, and the rule that matched.
About the company
A US company founded in 2005; its firewall is among the best-known network security appliances worldwide. PAN-OS is the operating system it runs.
What does an analyst do inside it?
- Reads the log to see whether the connection was allowed or denied.
- Follows `src` and `dst` to understand the direction of the connection.
- Distinguishes a port scan from repeated contact with an external server.
- Adds the dangerous address to a deny rule.
Its search language
These examples are written in the syntax the product itself accepts.
- src: 10.20.4.19
- action: deny
The field names it uses
- src
- dst
- action
- session_end_reason
- device_name
- srcuser
- type
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
Present in most large enterprises; reading its logs is a core skill for any network or SOC analyst.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.