Firewall (FW) audit logs in Google Distributed Cloud (GDC) air-gapped let you track administrative access and configuration activity on Palo Alto Firewall intrusion detection and prevention system (IDPS) hardware. These logs record the user or service identity, target, action, timestamp, and host IP address for web interface sign-ins, settings queries, and configuration commits.
IDPS firewall
| Workload location |
Hardware |
| Audit log source |
Palo Alto Firewall |
| Audited operations |
Log in to Web UI and show settings
| Fields in the log entry that contain audit information | ||
|---|---|---|
| Audit metadata | Audit field name | Value |
| User or service identity | message |
A subset of the
|
|
Target (Fields and values that call the API) |
message |
For example,
|
|
Action (Fields containing the performed operation) |
message
|
A subset of the
|
| Event timestamp | time |
For example,
|
| Source of action | host |
For example,
|
| Outcome | Not applicable | Not applicable |
| Other fields | Not applicable | Not applicable |
Example log
{
"pri": "14",
"time": "2022-11-22T12:03:55-08:00",
"host": "10.251.72.101",
"ident": "-",
"pid": "-",
"msgid": "-",
"extradata": "-",
"message": "012501009150,2022/11/22 12:03:54,audit,2561,gui-op,admin,\"<show><system><setting><multi-vsys/></setting></system></show>\",success",
"_gdch_cluster": "root-admin",
"_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-6lgds",
"_gdch_service_name": "panw_audit_logs"
}
Commit job changes
| Fields in the log entry that contain audit information | ||
|---|---|---|
| Audit metadata | Audit field name | Value |
| User or service identity | message |
A subset of the
|
|
Target (Fields and values that call the API) |
message |
For example,
|
|
Action (Fields containing the performed operation) |
message
|
A subset of the
|
| Event timestamp | time |
For example,
|
| Source of action | host |
For example,
|
| Outcome | Not applicable | Not applicable |
| Other fields | Not applicable | Not applicable |
Example log
{
"pri": "14",
"time": "2022-11-22T12:11:34-08:00",
"host": "10.251.72.101",
"ident": "-",
"pid": "-",
"msgid": "-",
"extradata": "-",
"message": "1,2022/11/22 12:11:33,012501009150,CONFIG,0,2561,2022/11/22 12:11:33,10.251.72.79,,commit,admin,Web,Submitted,,7168767370163388448,0x0,0,0,0,0,,zb-aa-fw01,0,,0,2022-11-22T12:11:34.635-08:00",
"_gdch_cluster": "root-admin",
"_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-6lgds",
"_gdch_service_name": "panw_audit_logs"
}