network:firewall
Firewall logs
- Host type
- Network devices and network sensors
- Tier, as a whole
- Minimum
- Cost class
- Paid service
- Techniques
- 19
- Rules listed
- 150
- Events
- 0
Why this tier
CISA CM0106; CISA/ASD priority source; OMB M-26-14 A2 (Network source and destination; our analysis)
Licensing
- License or service
- Strata Logging Service license
- What is free
- Telemetry-only unlicensed tenant
- What costs
- SLS license; "no activation email" without license
- Vendor page
- https://docs.paloaltonetworks.com/strata-logging-service/activation-and-onboarding/activate
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Network source and destination | Supports an activity | our analysis |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted: edge devices, such as boundary routers and firewalls |
| CISA: Web shell eviction countermeasure | names_source | quoted: logs to preserve: DMZ firewall |
Techniques
- T1021.005 VNC
- T1056 Input Capture
- T1090 Proxy
- T1090.001 Internal Proxy
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1090.004 Domain Fronting
- T1095 Non-Application Layer Protocol
- T1102.001 Dead Drop Resolver
- T1102.003 One-Way Communication
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer
- T1132.001 Standard Encoding
- T1132.002 Non-Standard Encoding
- T1133 External Remote Services
- T1135 Network Share Discovery
- T1499.001 OS Exhaustion Flood
- T1669 Wi-Fi Networks
- T1686.002 Network Device Firewall
Rules
Splunk 89
- Attacker Tools On Endpoint
- Cisco ASA - AAA Policy Tampering
- Cisco ASA - Core Syslog Message Volume Drop
- Cisco ASA - Device File Copy Activity
- Cisco ASA - Device File Copy to Remote Location
- Cisco ASA - Logging Disabled via CLI
- Cisco ASA - Logging Filters Configuration Tampering
- Cisco ASA - Logging Message Suppression
- Cisco ASA - New Local User Account Created
- Cisco ASA - Packet Capture Activity
- Cisco ASA - Reconnaissance Command Activity
- Cisco ASA - User Account Deleted From Local Database
- Cisco ASA - User Account Lockout Threshold Exceeded
- Cisco ASA - User Privilege Level Change
- Cisco NVM - Browser Spawned Unix Shell with External Connection
- Cisco NVM - Curl Execution With Insecure Flags
- Cisco NVM - Installation of Typosquatted Python Package
- Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI
- Cisco NVM - Non-Network Binary Making Network Connection
- Cisco NVM - Osascript Network Connection for a Long Duration
- Cisco NVM - Outbound Connection to Suspicious Port
- Cisco NVM - Rclone Execution With Network Activity
- Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download
- Cisco NVM - Susp Script From Archive Triggering Network Activity
- Cisco NVM - Suspicious Download From File Sharing Website
- Cisco NVM - Suspicious File Download via Headless Browser
- Cisco NVM - Suspicious Network Connection From Process With No Args
- Cisco NVM - Suspicious Network Connection Initiated via MsXsl
- Cisco NVM - Suspicious Network Connection to IP Lookup Service API
- Cisco NVM - Webserver Download From File Sharing Website
- Cisco Secure Firewall - Binary File Type Download
- Cisco Secure Firewall - Bits Network Activity
- Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint
- Cisco Secure Firewall - Blocked Connection
- Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt
- Cisco Secure Firewall - Communication Over Suspicious Ports
- Cisco Secure Firewall - Connection to File Sharing Domain
- Cisco Secure Firewall - File Download Over Uncommon Port
- Cisco Secure Firewall - High EVE Threat Confidence
- Cisco Secure Firewall - High Priority Intrusion Classification
- Cisco Secure Firewall - High Volume of Intrusion Events Per Host
- Cisco Secure Firewall - Intrusion Events by Threat Activity
- Cisco Secure Firewall - Lumma Stealer Activity
- Cisco Secure Firewall - Lumma Stealer Download Attempt
- Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt
- Cisco Secure Firewall - Malware File Downloaded
- Cisco Secure Firewall - Oracle E-Business Suite Correlation
- Cisco Secure Firewall - Oracle E-Business Suite Exploitation
- Cisco Secure Firewall - PHP2Shell Exploitation Attempt
- Cisco Secure Firewall - PHP2Shell Serialized Payload Activity
- Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity
- Cisco Secure Firewall - Possibly Compromised Host
- Cisco Secure Firewall - Potential Data Exfiltration
- Cisco Secure Firewall - Privileged Command Execution via HTTP
- Cisco Secure Firewall - Rare Snort Rule Triggered
- Cisco Secure Firewall - React Server Components RCE Attempt
- Cisco Secure Firewall - Remote Access Software Usage Traffic
- Cisco Secure Firewall - Repeated Blocked Connections
- Cisco Secure Firewall - Repeated Malware Downloads
- Cisco Secure Firewall - SSH Connection to Non-Standard Port
- Cisco Secure Firewall - SSH Connection to sshd_operns
- Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts
- Cisco Secure Firewall - Static Tundra Smart Install Abuse
- Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity
- Cisco Secure Firewall - Wget or Curl Download
- Detect HTML Help URL in Command Line
- Detect MSHTA Url in Command Line
- Detect Outbound LDAP Traffic
- Detect Outbound SMB Traffic
- Detect RClone Command-Line Usage
- Detect Remote Access Software Usage Traffic
- Internal Horizontal Port Scan
- Internal Horizontal Port Scan NMAP Top 20
- Internal Vertical Port Scan
- Prohibited Network Traffic Allowed
- Protocol or Port Mismatch
- Protocols passing authentication in cleartext
- TOR Traffic
- WMIC XSL Execution via URL
- Windows Curl Download to Suspicious Path
- Windows Curl Upload to Remote Destination
- Windows File Download Via CertUtil
- Windows File Download Via PowerShell
- Windows HTTP Network Communication From MSIExec
- Windows InstallUtil Remote Network Connection
- Windows InstallUtil URL in Command Line
- Windows MSIExec Remote Download
- Windows PowerShell FakeCAPTCHA Clipboard Execution
- Windows Remote Desktop Network Bruteforce Attempt
Sigma 2
- Cleartext Protocol Usage by Alexandr Yampolskyi, SOC Prime, Tim Shelton
- Equation Group C2 Communication by Florian Roth (Nextron Systems)
Elastic 35
- Abnormally Large DNS Response
- Accepted Default Telnet Port Connection
- Cobalt Strike Command and Control Beacon
- First Seen External MQTT Broker Connection
- First Time Seen RMM Service Hostname from Network DNS
- First-Time FortiGate Administrator Login
- FortiGate Administrator Account Creation from Unusual Source
- FortiGate Administrator Login from Multiple IP Addresses
- FortiGate Configuration File Downloaded
- FortiGate FortiCloud SSO Login from Unusual Source
- FortiGate Overly Permissive Firewall Policy Created
- FortiGate SOCKS Traffic from an Unusual Process
- FortiGate SSL VPN Login Followed by SIEM Alert by User
- FortiGate SSO Login Followed by Administrator Account Creation
- FortiGate Super Admin Account Creation
- Multiple RMM Vendors Queried by a Single DNS Client
- Newly Observed FortiGate Alert
- Newly Observed IPSEC NAT Traversal Peer
- Newly Observed Palo Alto Network Alert
- PANW and Elastic Defend - Command and Control Correlation
- Possible FIN7 DGA Command and Control Behavior
- Potential DNS Tunneling via NULL or Long DNS Queries
- Potential Network Scan Detected
- Potential Network Sweep Detected
- Potential SYN-Based Port Scan Detected
- RDP (Remote Desktop Protocol) from the Internet
- RPC (Remote Procedure Call) from the Internet
- RPC (Remote Procedure Call) to the Internet
- React2Shell Network Security Alert
- Roshal Archive (RAR) or PowerShell File Downloaded from the Internet
- SMB (Windows File Sharing) Activity from the Internet
- SMB (Windows File Sharing) Activity to the Internet
- SMTP to the Internet on Port 26/TCP
- VNC (Virtual Network Computing) from the Internet
- VNC (Virtual Network Computing) to the Internet
Microsoft Sentinel 24
- Cisco ASA - Possible Data Exfiltration Detection
- CloudNGFW By Palo Alto Networks - Threat signatures from Unusual IP addresses
- CloudNGFW By Palo Alto Networks - possible internal to external port scanning
- DNS events related to ToR proxies (ASIM DNS Schema)
- Fortinet - Beacon pattern detected
- IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPN
- Palo Alto - potential beaconing detected
- PaloAlto - Dropping or denying session with traffic
- PaloAlto - File type changed
- PaloAlto - Forbidden countries
- PaloAlto - Inbound connection to high risk ports
- PaloAlto - MAC address conflict
- PaloAlto - Possible attack without response
- PaloAlto - Possible flooding
- PaloAlto - Possible port scan
- PaloAlto - Put and post method request in high risk file type
- PaloAlto - User privileges was changed
- SonicWall - Allowed SSH, Telnet, and RDP Connections
- TI Map Domain entity to PaloAlto
- TI Map Email entity to PaloAlto CommonSecurityLog
- TI Map URL Entity to PaloAlto Data
- TI Map URL Entity to PaloAlto Data
- TI map Domain entity to PaloAlto
- TI map Email entity to PaloAlto CommonSecurityLog
Events
No event-level rows: this source is tiered as a whole.