MELTr
Home Vendors Search Download
Login
Vendors / Palo Alto Networks / PAN-OS / PAN-OS Traffic Flow Logs
Palo Alto Networks logo

Event type

PAN-OS Traffic Flow Logs

Network connection and policy enforcement events

Network traffic flow logs from PAN-OS 11.2 baseline (117 CSV fields through Cluster Name) showing connection details, policy decisions, and session information

CSV 50 fields Critical Generator

firewall network-traffic policy-enforcement session-monitoring threat-prevention
Preview Sample View Schema
CLI Install
meltr templates install paloalto

Overview

What this event covers

Records all network traffic sessions processed by the PAN-OS firewall, including connection details, policy decisions, data transfer statistics, and session lifecycle events. Essential for network monitoring, security analysis, and compliance reporting. The .j2 emits the full 117-field CSV lab baseline (see docs/panos-11.2-contract.md); documentation.fields below documents the primary operator-facing subset for registry UI, not every CSV column.

When generated

  • ›New network connection establishment (start)
  • ›Network connection termination (end)
  • ›Traffic blocked by security policy (deny)
  • ›Connection dropped due to resource constraints (drop)
  • ›Policy rule evaluation and enforcement
  • ›Application identification and control actions

Security relevance

Critical

Compliance

PCI DSS SOX HIPAA GDPR NIST Cybersecurity Framework ISO 27001

Frequency notes

Very high frequency during business hours due to active user traffic. Frequency varies based on network size, user activity, and policy configuration. Large enterprises may generate 10,000+ events per hour.

Resources

Docs and tools

PAN-OS Traffic Log Fields (current) official PAN-OS Administrator's Guide (PDF field tables) official MELTr PAN-OS 11.2 lab baseline reference Palo Alto Networks Next-Generation Firewall official PAN-OS CLI Command-line interface for log analysis and system management Panorama Centralized management and logging platform for PAN-OS devices AutoFocus Threat intelligence and analysis platform with log correlation

Generation

Configuration

Base frequency
180 events/hour
Time patterns
business_hours night_hours weekend
Business hours
2.5x
Night hours
0.8x
Weekend
0.4x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

domain
Integer Required

Virtual system domain identifier

Source: Static value

Example 1
receive_time
DateTime Required

Log entry reception timestamp

Source: ts | format_timestamp('%Y/%m/%d %H:%M:%S'), where ts = now()

Format YYYY/MM/DD HH:MM:SS
Example 2024/01/15 14:30:25
serial_number
String Required

Firewall device serial number

Source: random_string(16, '0123456789ABCDEF')

Example 44A1B3FC68F5304
log_type
String Required

Log category type

Source: Static value

Example TRAFFIC
log_subtype
String Required

Specific traffic event type

Source: log_sub_types | random

Example start
Values
  • start Session initiation
  • end Session termination
  • deny Traffic denied by policy
  • drop Traffic dropped
config_version
Integer Required

Configuration version number

Source: random_int(2000, 3000)

Example 2048
time_generated
DateTime Required

Event generation timestamp

Source: ts | format_timestamp('%Y/%m/%d %H:%M:%S'), where ts = now()

Format YYYY/MM/DD HH:MM:SS
Example 2024/01/15 14:30:25
high_res_timestamp
DateTime Required

Log reception time with millisecond precision and the configured timezone offset, derived from the same event clock as receive_time and time_generated.

Source: ts.isoformat(timespec='milliseconds'), where ts = now()

Format YYYY-MM-DDTHH:mm:ss.sss+/-HH:mm
Example 2026-09-04T21:06:31.128-05:00
source_ip
IP Address Required

Source IP address of the connection

Source: random_private_ip()

Example 192.168.1.100
destination_ip
IP Address Required

Destination IP address of the connection

Source: random_public_ip()

Example 8.8.8.8
nat_source_ip
IP Address Required

NAT translated source IP address

Source: registry.get_random_device().ip_address with fallback

Example 10.10.1.50
nat_destination_ip
IP Address Required

NAT translated destination IP address

Source: random_public_ip()

Example 203.0.113.10
rule_name
String Required

Generated to reflect the action, application type, and specific application

Source: Dynamically generated based on action and application

Example Allow_DNS
Values
  • Allow_DNS DNS traffic permission rule
  • Block_Malicious Malicious traffic blocking rule
  • Allow_Internal Internal network access rule
  • Allow_Web Web browsing permission rule
  • Default_Rule Catch-all default rule
source_user
String Optional

Username associated with source IP

Source: registry.get_random_user().username with fallback

Example jsmith
destination_user
String Optional

Username associated with destination

Source: destination_user_names | random

Example unknown
Values
  • unknown User not identified
  • admin Administrative user
  • guest Guest user account
  • external External user
application
String Required

Application selection determines protocol, ports, and valid actions

Source: Selected from app_groups based on application type

Example dns
virtual_system
String Required

Virtual system name

Source: Static value

Example vsys1
source_zone
String Required

Zones are selected to create realistic traffic patterns based on action

Source: Selected based on action and traffic direction

Example trust
Values
  • trust Trusted internal zone
  • lan Local area network zone
  • internal Internal network zone
  • DMZ-In DMZ ingress zone
  • VPN VPN user zone
destination_zone
String Required

Zones are selected to create realistic traffic patterns based on action

Source: Selected based on action and traffic direction

Example untrust
Values
  • untrust Untrusted external zone
  • dmz Demilitarized zone
  • external External network zone
  • internet Internet zone
  • Partner Partner network zone
ingress_interface
String Required

Ingress network interface

Source: ethernet1/{{ random_int(1, 3) }}

Example ethernet1/1
egress_interface
String Required

Egress network interface

Source: ethernet1/{{ random_int(1, 4) }}

Example ethernet1/2
log_action
String Required

Log forwarding action

Source: Static value

Example log-forwarding-default
session_id
Integer Required

Unique session identifier

Source: random_int(54320, 54399)

Example 54350
repeat_count
Integer Required

Number of session repeats

Source: Static value

Example 1
source_port
Integer Required

Ports are selected to be appropriate for the protocol and application

Source: Selected from application-appropriate port range

Example 54321
destination_port
Integer Required

Ports are selected to be appropriate for the protocol and application

Source: Selected from application-appropriate destination ports

Example 53
nat_source_port
Integer Required

NAT translated source port

Source: random_port()

Example 55123
nat_destination_port
Integer Required

NAT translated destination port

Source: common_ports | random

Example 80
flags
String Required

TCP flags and session attributes

Source: {{ random_hex(0, 67108864) }}

Format Hexadecimal
Example 0x401000
protocol
String Required

Protocol is determined by the selected application

Source: Determined by selected application group

Example tcp
Values
  • tcp Transmission Control Protocol
  • udp User Datagram Protocol
  • icmp Internet Control Message Protocol
  • esp Encapsulating Security Payload
  • gre Generic Routing Encapsulation
action
String Required

Actions are limited to those appropriate for the application type

Source: Selected from application-appropriate actions

Example allow
Values
  • allow Traffic permitted
  • deny Traffic denied
  • drop Traffic dropped silently
  • reset-client Reset sent to client
  • reset-server Reset sent to server
  • reset-both Reset sent to both endpoints
bytes_sent
Integer Required

Total bytes sent from source to destination

Source: random_int(0, 150000)

Example 1500
bytes_received
Integer Required

Total bytes received from destination to source

Source: random_int(0, 80000)

Example 800
packets_sent
Integer Required

Total packets sent from source to destination

Source: random_int(0, 70000)

Example 15
packets_received
Integer Required

Total packets received from destination to source

Source: random_int(0, 300)

Example 12
session_start_time
DateTime Required

Session start timestamp

Source: ts | subtract_seconds(random_int(1, 3600)) | format_timestamp('%Y/%m/%d %H:%M:%S'), where ts = now()

Format YYYY/MM/DD HH:MM:SS
Example 2024/01/15 14:30:20
elapsed_time
Integer Required

Session duration in seconds

Source: random_int(0, 120)

Example 45
category
String Required

URL/Application category

Source: categories | random

Example any
sequence_number
Integer Required

Log sequence number

Source: random_int(7892340, 7892399)

Example 7892350
action_flags
String Required

Action-specific flags

Source: Static value

Format Hexadecimal
Example 0x0
source_country
String Optional

Source IP geolocation country code

Source: country_names | random

Format Full country name or internal IP range
Example United States
destination_country
String Optional

Destination IP geolocation country code

Source: country_names | random, or private range for RFC1918 destinations

Format Full country name or internal IP range for private addresses
Example 10.0.0.0-10.255.255.255
packets_sent_total
Integer Optional

Total session packets sent

Source: random_int(0, 200)

Example 25
packets_received_total
Integer Optional

Total session packets received

Source: random_int(0, 150)

Example 20
session_end_reason
String Optional

Reason for session termination

Source: session_end_reasons | random

Example aged-out
Values
  • aged-out Session timeout
  • policy-deny Denied by policy
  • tcp-fin TCP FIN received
  • tcp-rst-from-client TCP reset from client
  • tcp-rst-from-server TCP reset from server
  • resources-unavailable System resource exhaustion
  • unknown Unknown termination reason
source_dag
String Optional

Source Dynamic Address Group

Source: src_dynamic_addr_groups | random

Example Corp-Internal
destination_dag
String Optional

Destination Dynamic Address Group

Source: dst_dynamic_addr_groups | random

Example Web-Server
risk_level
String Optional

Application risk assessment level

Source: group.app_risk (1-5 per PAN-OS application metadata)

Example 3
Values
  • 1 Low risk application
  • 2 Low-medium risk application
  • 3 Medium risk application
  • 4 High risk application
  • 5 Critical risk application
flow_type
String Optional

Proxy traffic indicator

Source: flow_type | random (PAN-OS 11.1+ flow_type field)

Example NonProxyTraffic
Values
  • Explicit Proxy Traffic through an explicit proxy
  • Transparent Proxy Traffic through a transparent proxy
  • NonProxyTraffic Direct traffic
tunnel_type
Integer Optional

VPN tunnel type

Source: Static 0 for standard traffic sessions

Example 0
Values
  • 0 N/A or non-tunneled session
  • 1 GRE tunnel
  • 2 IPSec tunnel