# Not reading threat input from Palo Alto **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [October 10, 2019, 2:46pm UTC](https://community.graylog.org/t/not-reading-threat-input-from-palo-alto/12323 "2019-10-10T14:46:24Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![yazool](https://avatars.discourse-cdn.com/v4/letter/y/7993a0/32.png) [@yazool](https://community.graylog.org/u/yazool)\ **Post date:** [October 10, 2019, 2:46pm UTC](https://community.graylog.org/t/not-reading-threat-input-from-palo-alto/12323/1 "2019-10-10T14:46:24Z")
Howdy, I’ve been working on manually setting up our Palo Alto inputs since all of the marketplace addons are using a newer version of Palo Alto than what we have set up. The input is working on all of the TRAFFIC and SYSTEM logs being sent, but for some reason THREAT logs are not being saved at all. I ran a packet capture on our graylog device and its receiving threat logs without issue. The following block is taken from following the TCP stream in Wireshark: 710 \<14\>1 2019-10-07T16:17:01-05:00 DEVICENAME - - - - 1,2019/10/07 16:17:01,001606066092,THREAT,url,1,2019/10/07 16:17:01,IPADRESS,IPADDRESS,IPADDRESS,IPADDRESS,RULENAME,USERNAME,google-base,vsys1,trust,untrust,ethernet1/2,ethernet1/1,Graylog,2019/10/07 16:17:01,26664,1,64720,443,65224,443,0x1403000,tcp,block-url,“[pagead2.googlesyndication.com/pagead/gen\_204?id=xbid&dbm\_b=AKAmf-C\_dOwNGIfHhi0R6W7AswknGdH3c-n1xZKd79oEF9pIT-HUWCxy8dR2vf4el7zIJjoy15v-xQqrCCeeTXpPHb17xf9-fWEAAiuhqdw36bkJHXeRWDg](http://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C_dOwNGIfHhi0R6W7AswknGdH3c-n1xZKd79oEF9pIT-HUWCxy8dR2vf4el7zIJjoy15v-xQqrCCeeTXpPHb17xf9-fWEAAiuhqdw36bkJHXeRWDg)”,(9999),web-advertisements,informational,client-to-server,1023379,0x0,10.0.0.0-10.255.255.255,United States,0,0,1,0,0,0,0,0,DEVICENAME,get,0,0,N/A,unknown,AppThreat-0-0,0x0 I followed the syslog [threat fields for our version](https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/threat-log-fields.html) and triple-checked that they’re set up correctly, I even made sure that there were no slashes that might cause an escape as well. I have the threat log input set up like this: position,field,type 1,Receive\_Time,STRING 2,Serial\_Number,STRING 3,Type,STRING 4,Threat\_Content\_Type,STRING 5,FUTURE\_USE,STRING 6,Generated\_Time,STRING 7,Source\_IP,STRING 8,Destination\_IP,STRING 9,NAT\_Source\_IP,STRING 10,NAT\_Destination\_IP,STRING 11,Rule\_Name,STRING 12,Source\_User,STRING 13,Destination\_User,STRING 14,Application,STRING 15,Virtual\_System,STRING 16,Source\_Zone,STRING 17,Destination\_Zone,STRING 18,Inbound\_Interface,STRING 19,Outbound\_Interface,STRING 20,Log\_Action,STRING 21,FUTURE\_USE,STRING 22,Session\_ID,STRING 23,Repeat\_Count,STRING 24,Source\_Port,STRING 25,Destination\_Port,STRING 26,NAT\_Source\_Port,STRING 27,NAT\_Destination\_Port,STRING 28,Flags,STRING 29,Protocol,STRING 30,Action,STRING 31,URL\_Filename,STRING 32,Threat\_ID,STRING 33,Category,STRING 34,Severity,STRING 35,Direction,STRING 36,Sequence\_Number,STRING 37,Action\_Flags,STRING 38,Source\_Location,STRING 39,Destination\_Location,STRING 40,FUTURE\_USE,STRING 41,Content\_Type,STRING 42,PCAP\_ID,STRING 43,File\_Digest,STRING 44,Cloud,STRING 45,URL\_Index,STRING 46,User\_Agent,STRING 47,File\_Type,STRING 48,X\_Forwarded\_For,STRING 49,Referrer,STRING 50,Sender,STRING 51,Subject,STRING 52,Recipient,STRING 53,Report\_ID,STRING 54,Device\_Group\_Hierarchy\_Level\_1,STRING 55,Device\_Group\_Hierarchy\_Level\_2,STRING 56,Device\_Group\_Hierarchy\_Level\_3,STRING 57,Device\_Group\_Hierarchy\_Level\_4,STRING 58,Virtual\_System\_Name,STRING 59,Device\_Name,STRING 60,FUTURE\_USE,STRING 61,Source\_VM\_UUID,STRING 62,Destination\_VM\_UUID,STRING 63,HTTP\_Method,STRING 64,Tunnel\_ID\_IMSI,STRING 65,Monitor\_Tag\_IMEI,STRING 66,Parent\_Session\_ID,STRING 67,Parent\_Start\_Time,STRING 68,Tunnel\_Type,STRING 69,Threat\_Category,STRING 70,Content\_Version,STRING 71,FUTURE\_USE,STRING Any ideas as to why the input might be being ignored? Thanks! ---
**Author:** ![cawfehman](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/cawfehman/32/4132_2.png) [@cawfehman](https://community.graylog.org/u/cawfehman)\ **Post date:** [October 10, 2019, 8:54pm UTC](https://community.graylog.org/t/not-reading-threat-input-from-palo-alto/12323/2 "2019-10-10T20:54:01Z")
I’m assuming you meant the content pack addons in the Marketplace. Have you looked at the integration for Palo? I have no experience with it, but this may solve your problem. [http://docs.graylog.org/en/3.1/pages/integrations/inputs/palo\_alto\_networks\_input.html#palo-alto-network-input](http://docs.graylog.org/en/3.1/pages/integrations/inputs/palo_alto_networks_input.html#palo-alto-network-input) ---
**Author:** ![yazool](https://avatars.discourse-cdn.com/v4/letter/y/7993a0/32.png) [@yazool](https://community.graylog.org/u/yazool)\ **Post date:** [October 10, 2019, 9:48pm UTC](https://community.graylog.org/t/not-reading-threat-input-from-palo-alto/12323/3 "2019-10-10T21:48:33Z")
Hi cawfehman, Thanks for taking the time to reply. Sorry for not clarifying in my first post, but I am using the integration and not the content packs. We’re currently running Pan-OS 8.0 and Graylog 3.1 - I’ve stayed away from the content packs since they’re either deprecated or set up for Pan-OS 8.1. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [October 11, 2019, 6:59am UTC](https://community.graylog.org/t/not-reading-threat-input-from-palo-alto/12323/4 "2019-10-11T06:59:40Z")
if you can share how that can be reproduce please open an issue: > **[Graylog2/graylog-plugin-integrations](https://github.com/Graylog2/graylog-plugin-integrations/issues)** > > A collection of open source Graylog integrations that will be released together. - Graylog2/graylog-plugin-integrations for that. ---
**Author:** ![yazool](https://avatars.discourse-cdn.com/v4/letter/y/7993a0/32.png) [@yazool](https://community.graylog.org/u/yazool)\ **Post date:** [October 11, 2019, 4:51pm UTC](https://community.graylog.org/t/not-reading-threat-input-from-palo-alto/12323/5 "2019-10-11T16:51:12Z")
Thank you Jan, I’ve posted it > > > Description > While traffic and system logs are being read from a firewall running PAN-OS 8.0, graylog is not recording any threat logs... ---
**Author:** ![yazool](https://avatars.discourse-cdn.com/v4/letter/y/7993a0/32.png) [@yazool](https://community.graylog.org/u/yazool)\ **Post date:** [October 14, 2019, 3:25pm UTC](https://community.graylog.org/t/not-reading-threat-input-from-palo-alto/12323/6 "2019-10-14T15:25:48Z")
I resolved this. For Traffic and System the Palo Alto documentation has numbers after each FUTURE\_USE field (i.e. FUTURE\_USE1, FUTURE\_USE2). Threat didn’t have these so it was causing an exception when writing to each of them. I added the numbers and it works. Thank you ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [October 28, 2019, 3:25pm UTC](https://community.graylog.org/t/not-reading-threat-input-from-palo-alto/12323/7 "2019-10-28T15:25:49Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.