Sending Palo Alto Firewall Logs to SignLogger in CEF Format: Step-by-Step Configuration Guide

This guide walks you through configuring your Palo Alto Networks firewall (PAN-OS 10.x) to send its logs to SignLogger in CEF (Common Event Format). It covers creating the syslog server profile, defining copy-paste-ready CEF custom log formats for every log type, attaching the log forwarding profile to security rules, and verifying the setup.

Overview

CEF is a widely adopted log format that lets records from different vendors share a single common schema. Palo Alto Networks firewalls can send syslog in CEF by defining a Custom Log Format per log type. SignLogger receives these CEF logs, parses them, and archives them with timestamps and digital signatures in compliance with Türkiye's Law 5651.

The configuration has four parts, all done in the Palo Alto web interface:

1. Syslog server profile: defining the SignLogger destination (Steps 1–2).
2. CEF custom log formats: pasting the format strings per log type (Step 3).
3. Log forwarding: deciding which logs flow to the profile (Steps 4–5).
4. Commit and verification: activating the settings and checking log flow (Step 7).

Note: menu paths follow the PAN-OS 10.x web UI; on Panorama the same settings are applied via Panorama > Device templates. Field names in PAN-OS 8.x/9.x are largely identical, but use the CEF guide matching your version.

Prerequisites

• An administrator account (superuser or device admin) on the Palo Alto firewall.
• Your SignLogger server's IP address (examples use 10.100.100.253).
• Reachability from the firewall's management (or chosen service) interface to SignLogger on UDP 514.
• The Palo Alto device registered as a source in SignLogger — if not yet, follow the License Activation and Firewall Device Setup Guide.

Step 1: Set the Syslog HOSTNAME Format to IP Address

Why: SignLogger identifies the sending device from the HOSTNAME field in the syslog header. Using the IP address instead of a hostname guarantees that logs match the device record defined in SignLogger.

How:

1. Go to Device > Setup > Management (on Panorama: Panorama > Setup > Management).
2. Click the edit (gear) icon in Logging and Reporting Settings.
3. Switch to the Log Export and Reporting tab.
4. Set Syslog HOSTNAME Format to ipv4-address (or ipv6-address).
5. Save with OK.

Step 2: Create the Syslog Server Profile for SignLogger

Why: the syslog server profile defines where logs go and over which protocol and port. The CEF format strings are written into this same profile, so all following steps happen here.

How:

1. Go to Device > Server Profiles > Syslog and click Add.
2. Name the profile SignLogger-CEF. If the device has multiple virtual systems, pick the vsys under Location.
3. On the Servers tab, click Add and enter:

Don't close the profile yet — the next step uses the Custom Log Format tab of this same window.

Step 3: Define the CEF Custom Log Formats

Why: by default Palo Alto sends its own delimited log format. For SignLogger to parse logs in the CEF schema, each log type needs a custom format string mapping its fields to CEF keys. The strings below are based on the certified formats in Palo Alto's PAN-OS 10.0 CEF Configuration Guide.

Where: in the SignLogger-CEF profile opened in Step 2, switch to the Custom Log Format tab. Click a log type (e.g. Traffic), paste the corresponding string into the text area, and click OK. Repeat for every log type you want to forward.

Before You Copy

• The format string must be a single line. The Copy button in the top-right corner of each block below copies the string as one line with no line-break characters. Do not copy from Palo Alto's PDF guide — PDF copies pick up line breaks and corrupt the format (the guide itself warns about this).
• 2048-character limit: PAN-OS accepts at most 2048 characters in the Custom Log Format field. The full certified Traffic, Threat, URL and Decryption formats exceed this limit, so shortened versions that fit — while keeping every field SignLogger needs — are provided below. The omitted fields belong to special scenarios such as SD-WAN, IoT device inventory, container/Kubernetes and 5G; everything required for Law 5651 records (source/destination IPs and ports, NAT details, user, rule, zones, byte counts, URL and category, session details) is preserved.
• Check after pasting: confirm the text starts with CEF:0| and is one piece to the end.
• Escaping (optional): to avoid = characters inside log content confusing CEF parsers, tick Escaping in the same dialog and set Escaped Characters to \= and Escape Character to \.

Traffic Logs

Traffic logs carry each session's source/destination IPs and ports, NAT translations, user and application, byte counters and session timing. They are the foundation of Law 5651 access records — configure them without exception. Paste into Custom Log Format > Traffic:

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$subtype|$type|1|rt=$cef-formatted-receive_time deviceExternalId=$serial src=$src dst=$dst sourceTranslatedAddress=$natsrc destinationTranslatedAddress=$natdst cs1Label=Rule cs1=$rule suser=$srcuser duser=$dstuser app=$app cs3Label=Virtual System cs3=$vsys cs4Label=Source Zone cs4=$from cs5Label=Destination Zone cs5=$to deviceInboundInterface=$inbound_if deviceOutboundInterface=$outbound_if cs6Label=LogProfile cs6=$logset cn1Label=SessionID cn1=$sessionid cnt=$repeatcnt spt=$sport dpt=$dport sourceTranslatedPort=$natsport destinationTranslatedPort=$natdport flexString1Label=Flags flexString1=$flags proto=$proto act=$action flexNumber1Label=Total bytes flexNumber1=$bytes in=$bytes_received out=$bytes_sent cn2Label=Packets cn2=$packets PanOSPacketsReceived=$pkts_received PanOSPacketsSent=$pkts_sent start=$cef-formatted-time_generated cn3Label=Elapsed time in seconds cn3=$elapsed cs2Label=URL Category cs2=$category externalId=$seqno reason=$session_end_reason PanOSVsysName=$vsys_name dvchost=$device_name cat=$action_source PanOSActionFlags=$actionflags PanOSRuleUUID=$rule_uuid PanXFFIP=$xff_ip PanTimeHighRes=$high_res_timestamp

This is the shortened version that fits the 2048-character limit (1193 characters). The full certified format is 2643 characters and is rejected by the PAN-OS interface.

URL Filtering Logs

URL logs carry visited web addresses, categories, HTTP method and browser details. They are the most critical log type for Law 5651 URL access records; configure them together with traffic logs. Paste into Custom Log Format > URL:

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$subtype|$type|$number-of-severity|rt=$cef-formatted-receive_time deviceExternalId=$serial src=$src dst=$dst sourceTranslatedAddress=$natsrc destinationTranslatedAddress=$natdst cs1Label=Rule cs1=$rule suser=$srcuser duser=$dstuser app=$app cs3Label=Virtual System cs3=$vsys cs4Label=Source Zone cs4=$from cs5Label=Destination Zone cs5=$to deviceInboundInterface=$inbound_if deviceOutboundInterface=$outbound_if cs6Label=LogProfile cs6=$logset cn1Label=SessionID cn1=$sessionid cnt=$repeatcnt spt=$sport dpt=$dport sourceTranslatedPort=$natsport destinationTranslatedPort=$natdport flexString1Label=Flags flexString1=$flags proto=$proto act=$action request=$misc cs2Label=URL Category cs2=$category flexString2Label=Direction flexString2=$direction PanOSActionFlags=$actionflags externalId=$seqno requestContext=$contenttype cat=$threatid requestMethod=$http_method requestClientApplication=$user_agent PanOSXForwarderfor=$xff PanOSReferer=$referer PanOSVsysName=$vsys_name dvchost=$device_name PanOSURLCatList=$url_category_list PanOSRuleUUID=$rule_uuid PanTimeHighRes=$high_res_timestamp

Shortened to fit the 2048 limit (1140 characters). For User-Agent, Referer and X-Forwarded-For to be populated, also enable HTTP Header Logging in Step 6.

Threat Logs

Threat logs carry security events: IPS signature hits, virus/spyware detections and blocked file transfers. Recommended for evidencing security incidents in SignLogger. Paste into Custom Log Format > Threat:

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$threatid|$type|$number-of-severity|rt=$cef-formatted-receive_time deviceExternalId=$serial src=$src dst=$dst sourceTranslatedAddress=$natsrc destinationTranslatedAddress=$natdst cs1Label=Rule cs1=$rule suser=$srcuser duser=$dstuser app=$app cs3Label=Virtual System cs3=$vsys cs4Label=Source Zone cs4=$from cs5Label=Destination Zone cs5=$to deviceInboundInterface=$inbound_if deviceOutboundInterface=$outbound_if cs6Label=LogProfile cs6=$logset cn1Label=SessionID cn1=$sessionid cnt=$repeatcnt spt=$sport dpt=$dport sourceTranslatedPort=$natsport destinationTranslatedPort=$natdport flexString1Label=Flags flexString1=$flags proto=$proto act=$action request=$misc cs2Label=URL Category cs2=$category flexString2Label=Direction flexString2=$direction PanOSActionFlags=$actionflags externalId=$seqno cat=$subtype fileId=$pcap_id PanOSVsysName=$vsys_name dvchost=$device_name PanOSThreatCategory=$thr_category PanOSContentVer=$contentver PanOSURLCatList=$url_category_list PanOSRuleUUID=$rule_uuid PanXFFIP=$xff_ip PanTimeHighRes=$high_res_timestamp

Shortened to fit the 2048 limit (1097 characters).

System Logs

System logs carry the device's own operational events — interface drops, HA events, admin sessions, service errors. Recommended for monitoring device health through SignLogger. Paste into Custom Log Format > System:

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$subtype|$type|$number-of-severity|rt=$cef-formatted-receive_time deviceExternalId=$serial cs3Label=Virtual System cs3=$vsys fname=$object flexString2Label=Module flexString2=$module msg=$opaque externalId=$seqno cat=$eventid PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name PanOSActionFlags=$actionflags PanOSTimeGeneratedHighResolution=$high_res_timestamp

Config Logs

Config logs record who changed which setting and when, including before/after detail — recommended for audit-trail requirements. Paste into Custom Log Format > Config:

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$result|$type|1|rt=$cef-formatted-receive_time deviceExternalId=$serial shost=$host cs3Label=Virtual System cs3=$vsys act=$cmd duser=$admin destinationServiceName=$client msg=$path externalId=$seqno PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name PanOSActionFlags=$actionflags cs1Label=Before Change Detail cs1=$before-change-detail cs2Label=After Change Detail cs2=$after-change-detail PanOSFWDeviceGroup=$dg_id PanOSPolicyAuditComment=$comment

If you have defined the five core log types, click OK twice to save the profile and continue with Step 4. If your deployment uses any of the optional log types below, define their formats first the same way.

CEF Formats for Optional Log Types

The following log types are not present in every deployment; define a format only if you use the corresponding feature. The method is identical: click the log type on the Custom Log Format tab, paste, and confirm. The mobile-operator-specific GTP and SCTP log types are out of scope for this guide; see the vendor guide if needed.

Data Filtering Logs

Carries events triggered by data filtering profiles (DLP-style content inspection).

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$subtype|$type|$number-of-severity|rt=$cef-formatted-receive_time deviceExternalId=$serial src=$src dst=$dst sourceTranslatedAddress=$natsrc destinationTranslatedAddress=$natdst cs1Label=Rule cs1=$rule suser=$srcuser duser=$dstuser app=$app cs3Label=Virtual System cs3=$vsys cs4Label=Source Zone cs4=$from cs5Label=Destination Zone cs5=$to deviceInboundInterface=$inbound_if deviceOutboundInterface=$outbound_if cs6Label=LogProfile cs6=$logset cn1Label=SessionID cn1=$sessionid cnt=$repeatcnt spt=$sport dpt=$dport sourceTranslatedPort=$natsport destinationTranslatedPort=$natdport flexString1Label=Flags flexString1=$flags proto=$proto act=$action request=$misc cs2Label=URL Category cs2=$category flexString2Label=Direction flexString2=$direction PanOSActionFlags=$actionflags externalId=$seqno cat=$threatid fileId=$pcap_id PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name PanOSSrcUUID=$src_uuid PanOSDstUUID=$dst_uuid PanOSTunnelID=$tunnelid PanOSMonitorTag=$monitortag PanOSParentSessionID=$parent_session_id PanOSParentStartTime=$parent_start_time PanOSTunnelType=$tunnel PanOSThreatCategory=$thr_category PanOSContentVer=$contentver PanOSAssocID=$assoc_id PanOSPPID=$ppid PanOSHTTPHeader=$http_headers PanOSRuleUUID=$rule_uuid

WildFire Logs

Carries the analysis verdicts (malicious/clean) of files submitted to WildFire cloud analysis.

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$subtype|$type|$number-of-severity|rt=$cef-formatted-receive_time deviceExternalId=$serial src=$src dst=$dst sourceTranslatedAddress=$natsrc destinationTranslatedAddress=$natdst cs1Label=Rule cs1=$rule suser=$srcuser duser=$dstuser app=$app cs3Label=Virtual System cs3=$vsys cs4Label=Source Zone cs4=$from cs5Label=Destination Zone cs5=$to deviceInboundInterface=$inbound_if deviceOutboundInterface=$outbound_if cs6Label=LogProfile cs6=$logset cn1Label=SessionID cn1=$sessionid cnt=$repeatcnt spt=$sport dpt=$dport sourceTranslatedPort=$natsport destinationTranslatedPort=$natdport flexString1Label=Flags flexString1=$flags proto=$proto act=$action request=$misc cs2Label=URL Category cs2=$category flexString2Label=Direction flexString2=$direction PanOSActionFlags=$actionflags externalId=$seqno cat=$threatid filePath=$cloud fileId=$pcap_id fileHash=$filedigest fileType=$filetype suid=$sender msg=$subject duid=$recipient oldFileId=$reportid PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name PanOSSrcUUID=$src_uuid PanOSDstUUID=$dst_uuid PanOSTunnelID=$tunnelid PanOSMonitorTag=$monitortag PanOSParentSessionID=$parent_session_id PanOSParentStartTime=$parent_start_time PanOSTunnelType=$tunnel PanOSThreatCategory=$thr_category PanOSContentVer=$contentver PanOSAssocID=$assoc_id PanOSPPID=$ppid PanOSHTTPHeader=$http_headers PanOSRuleUUID=$rule_uuid

Tunnel Inspection Logs

Carries inspection records of traffic inside GRE, IPSec and similar tunnels.

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$subtype|$type|1|rt=$cef-formatted-receive_time deviceExternalId=$serial src=$src dst=$dst sourceTranslatedAddress=$natsrc destinationTranslatedAddress=$natdst cs1Label=Rule cs1=$rule suser=$srcuser duser=$dstuser app=$app cs3Label=Virtual System cs3=$vsys cs4Label=Source Zone cs4=$from cs5Label=Destination Zone cs5=$to deviceInboundInterface=$inbound_if deviceOutboundInterface=$outbound_if cs6Label=Log Action cs6=$logset cn1Label=SessionID cn1=$sessionid cnt=$repeatcnt spt=$sport dpt=$dport sourceTranslatedPort=$natsport destinationTranslatedPort=$natdport flexString1Label=Flags flexString1=$flags proto=$proto act=$action externalId=$seqno PanOSActionFlags=$actionflags PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name PanOSTunnelID=$tunnelid PanOSMonitorTag=$monitortag PanOSParentSessionID=$parent_session_id PanOSParentStartTime=$parent_start_time cs2Label=Tunnel Type cs2=$tunnel flexNumber1Label=Total bytes flexNumber1=$bytes in=$bytes_received out=$bytes_sent cn2Label=Packets cn2=$packets PanOSPacketsSent=$pkts_sent PanOSPacketsReceived=$pkts_received flexNumber2Label=Maximum Encapsulation flexNumber2=$max_encap cfp1Label=Unknown Protocol cfp1=$unknown_proto cfp2Label=Strict Checking cfp2=$strict_check PanOSTunnelFragment=$tunnel_fragment cfp3Label=Sessions Created cfp3=$sessions_created cfp4Label=Sessions Closed cfp4=$sessions_closed reason=$session_end_reason cat=$action_source start=$cef-formatted-time_generated cn3Label=Elapsed time in seconds cn3=$elapsed PanOSTunneInspectionRule=$tunnel_insp_rule PanOSRmtUserIP=$remote_user_ip PanOSRmtUserID=$remote_user_id PanOSRuleUUID=$rule_uuid PanOSPcapID=$pcap_id PanDynamicUsrgrp=$dynusergroup_name PanOSSourceEDL=$src_edl PanOSDestinationEDL=$dst_edl PanOSTimeGeneratedHighResolution=$high_res_timestamp

Authentication Logs

Carries the outcomes of authentication attempts made through Authentication Policy.

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$subtype|$type|1|rt=$cef-formatted-receive_time deviceExternalId=$serial cs1Label=Server Profile cs1=$serverprofile cs2Label=Normalize User cs2=$normalize_user cs3Label=Virtual System cs3=$vsys cs4Label=Authentication Policy cs4=$authpolicy cs5Label=Client Type cs5=$clienttype cs6Label=Log Action cs6=$logset fname=$object cn1Label=Factor Number cn1=$factorno cn2Label=Authentication ID cn2=$authid src=$ip cnt=$repeatcnt duser=$user flexString2Label=Vendor flexString2=$vendor msg=$event externalId=$seqno PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name PanOSActionFlags=$actionflags PanOSDesc=$desc PanOSRuleUUID=$rule_uuid PanOSTimeGeneratedHighResolution=$high_res_timestamp PanOSSourceDeviceCategory=$src_category PanOSSourceDeviceProfile=$src_profile PanOSSourceDeviceModel=$src_model PanOSSourceDeviceVendor=$src_vendor PanOSSourceDeviceOSFamily=$src_osfamily PanOSSourceDeviceOSVersion=$src_osversion PanOSSourceHostname=$src_host PanOSSourceMac=$src_mac PanOSTrafficOriginRegion=$region PanOSHTTPUserAgent=$user_agent PanOSTrafficSessionID=$sessionid

User-ID Logs

Carries where IP-to-user mappings were learned from and their timeouts. Recommended if you report per user.

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$subtype|$type|1|rt=$cef-formatted-receive_time deviceExternalId=$serial cs1Label=Factor Type cs1=$factortype cs3Label=Virtual System cs3=$vsys cs4Label=Data Source Name cs4=$datasourcename cs5Label=Data Source cs5=$datasource cs6Label=Data Source Type cs6=$datasourcetype cn1Label=Factor Number cn1=$factorno cn2Label=Virtual System ID cn2=$vsys_id cn3Label=Timeout Threshold cn3=$timeout src=$ip spt=$beginport dpt=$endport cnt=$repeatcnt duser=$user externalId=$seqno cat=$eventid end=$factorcompletiontime PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name PanOSActionFlags=$actionflags PanOSUGFlags=$ugflags PanOSUserBySource=$userbysource PanOSTimeGeneratedHighResolution=$high_res_timestamp

HIP Match Logs

Carries GlobalProtect clients' HIP (Host Information Profile) compliance match events.

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$matchtype|$type|1|rt=$cef-formatted-receive_time deviceExternalId=$serial suser=$srcuser cs3Label=Virtual System cs3=$vsys shost=$machinename src=$src cnt=$repeatcnt externalId=$seqno cat=$matchname start=$cef-formatted-time_generated cs2Label=Operating System cs2=$os PanOSActionFlags=$actionflags PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name cn2Label=Virtual System ID cn2=$vsys_id c6a2Label=IPv6 Source Address c6a2=$srcipv6 PanOSHostID=$hostid PanOSEndpointSerialNumber=$serialnumber PanOSEndpointMac=$mac PanOSTimeGeneratedHighResolution=$high_res_timestamp

GlobalProtect Logs

Carries GlobalProtect VPN sign-in/sign-out, gateway selection and connection events. Recommended for remote-access VPN user records.

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$type|$subtype|rt=$receive_time PanOSDeviceSN=$serial PanOSLogTimeStamp=$time_generated PanOSVirtualSystem=$vsys PanOSEventID=$eventid PanOSStage=$stage PanOSAuthMethod=$auth_method PanOSTunnelType=$tunnel_type PanOSSourceUserName=$srcuser PanOSSourceRegion=$srcregion PanOSEndpointDeviceName=$machinename PanOSPublicIPv4=$public_ip PanOSPublicIPv6=$public_ipv6 PanOSPrivateIPv4=$private_ip PanOSPrivateIPv6=$private_ipv6 PanOSHostID=$hostid PanOSDeviceSN=$serialnumber PanOSGlobalProtectClientVersion=$client_ver PanOSEndpointOSType=$client_os PanOSEndpointOSVersion=$client_os_ver PanOSCountOfRepeats=$repeatcnt PanOSQuarantineReason=$reason PanOSConnectionError=$error PanOSDescription=$opaque PanOSEventStatus=$status PanOSGPGatewayLocation=$location PanOSLoginDuration=$login_duration PanOSConnectionMethod=$connect_method PanOSConnectionErrorID=$error_code PanOSPortal=$portal PanOSSequenceNo=$seqno PanOSActionFlags=$actionflags PanOSTimeGeneratedHighResolution=$high_res_timestamp PanOSGatewaySelectionType=$selection_type PanOSSSLResponseTime=$response_time PanOSGatewayPriority=$priority PanOSAttemptedGateways=$attempted_gateways PanOSGateway=$gateway

IP-Tag Logs

Carries IP-to-tag mapping changes used by dynamic address groups.

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$subtype|$type|1|rt=$cef-formatted-receive_time deviceExternalId=$serial cs3Label=Virtual System cs3=$vsys src=$ip PanOSTagName=$tag_name PanOSEventID=$event_id cnt=$repeatcnt PanOSTimeout=$timeout PanOSDataSourceName=$datasourcename PanOSDataSourceType=$datasource_type PanOSDataSourceSubType=$datasource_subtype externalId=$seqno PanOSActionFlags=$actionflags PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOsVsysName=$vsys_name dvchost=$device_name cn2Label=Virtual System ID cn2=$vsys_id PanOSTimeGeneratedHighResolution=$high_res_timestamp

Decryption Logs

Carries TLS version, certificate and handshake details of sessions processed by the SSL/TLS decryption policy.

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$type|$subtype|rt=$receive_time PanOSDeviceSN=$serial PanOSConfigVersion=$config_ver PanOSLogTimeStamp=$time_generated src=$src dst=$dst sourceTranslatedAddress=$natsrc destinationTranslatedAddress=$natdst cs1Label=Rule cs1=$rule suser=$srcuser duser=$dstuser app=$app cs3Label=Virtual System cs3=$vsys cs4Label=Source Zone cs4=$from cs5Label=Destination Zone cs5=$to deviceInboundInterface=$inbound_if deviceOutboundInterface=$outbound_if cs6Label=LogProfile cs6=$logset cn1Label=SessionID cn1=$sessionid PanOSCountOfRepeats=$repeatcnt spt=$sport dpt=$dport sourceTranslatedPort=$natsport destinationTranslatedPort=$natdport flexString1Label=Flags flexString1=$flags proto=$proto act=$action PanOSTunnel=$tunnel PanOSRuleUUID=$rule_uuid PanOSClientToFirewall=$hs_stage_c2f PanOSFirewallToServer=$hs_stage_f2s PanOSTLSVersion=$tls_version PanOSTLSKeyExchange=$tls_keyxchg PanOSTLSEncryptionAlgorithm=$tls_enc PanOSTLSAuth=$tls_auth PanOSPolicyName=$policy_name PanOSEllipticCurve=$ec_curve PanOSErrorIndex=$err_index PanOSRootStatus=$root_status PanOSChainStatus=$chain_status PanOSProxyType=$proxy_type PanOSCertificateSerial=$cert_serial PanOSFingerprint=$fingerprint PanOSTimeNotBefore=$notbefore PanOSTimeNotAfter=$notafter PanOSCommonName=$cn PanOSIssuerCommonName=$issuer_cn PanOSRootCommonName=$root_cn PanOSServerNameIndication=$sni PanOSErrorMessage=$error PanOSLogTypeSeqNo=$seqno PanOSActionFlags=$actionflags

Shortened to fit the 2048 limit (1471 characters); the vendor guide's full format is 2708 characters, and known typos in the vendor document are corrected in this version.

Correlation Logs

Carries higher-level threat findings produced by correlating multiple logs. This type is listed only on Panorama and high-end platforms such as the PA-3000/5000/5200/7000 series.

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$category|$type|$severity|rt=$cef-formatted-receive_time deviceExternalId=$serial start=$cef-formatted-time_generated src=$src suser=$srcuser cs3Label=Virtual System cs3=$vsys severity=$severity PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name cn2Label=Virtual System ID cn2=$vsys_id fname=$object_name cn3Label=Object ID cn3=$object_id msg=$evidence

Step 4: Create the Log Forwarding Profile and Attach It to Security Rules

Why: Traffic, Threat, URL, Data, WildFire and Tunnel logs are per security rule: a syslog profile alone is not enough — a Log Forwarding profile decides which rules' logs go where. If the profile is not attached to rules, the device produces logs but sends nothing to SignLogger. This is the most commonly missed step.

How:

1. Go to Objects > Log Forwarding, click Add and name the profile SignLogger-LF.
2. Click Add to create a match list: set Log Type to traffic, tick the SignLogger-CEF profile under Syslog, then OK.
3. Repeat for the other rule-based types you want: threat, url, and if needed data, wildfire, tunnel, auth and decryption.
4. Save the profile with OK.
5. Under Policies > Security, open every rule whose logs should reach SignLogger; on the Actions tab select SignLogger-LF as Log Forwarding and make sure Log at Session End is ticked.

Tip: with many rules, instead of attaching the profile one by one you can create the profile with the name default — PAN-OS automatically applies a profile named default to new rules.

Step 5: Enable Forwarding of System Logs

Why: System, Config, User-ID, HIP Match, GlobalProtect and IP-Tag logs are not tied to security rules; their forwarding is configured device-wide in a separate place.

How: go to Device > Log Settings. For each section you want to forward (System, Configuration, User-ID, HIP Match, GlobalProtect, IP-Tag) click Add, give it a name (e.g. SignLogger-System), tick the SignLogger-CEF profile under Syslog and confirm. Leave the System filter at All Logs to cover every severity.

Step 6 (Optional): Add User-Agent, Referer and X-Forwarded-For to URL Logs

Why: for the requestClientApplication (User-Agent), PanOSReferer and PanOSXForwarderfor fields in the URL format to be populated, HTTP header logging must be enabled in the URL Filtering profile. X-Forwarded-For matters especially when a proxy sits in front of the firewall and the real client IP must be recorded.

How: under Objects > Security Profiles > URL Filtering, open your profile and tick User-Agent, Referer and X-Forwarded-For in the URL Filtering Settings (HTTP Header Logging) section, then confirm.

Step 7: Commit and Verify

Activate everything with Commit (top right). Then verify log flow on both sides:

1. On the Palo Alto: watch new logs appear under Monitor > Logs > Traffic. Browsing a few websites from a client behind a rule with the Log Forwarding profile attached is enough to generate traffic.
2. On SignLogger: open the SignLogger management interface and confirm logs are arriving for the Palo Alto device record. If nothing appears within a few minutes, use the Troubleshooting section below.

Troubleshooting

Resources

• PAN-OS 10.0 CEF Configuration Guide (Palo Alto Networks, PDF) — the certified vendor guide these format strings are based on.
• PAN-OS Administrator's Guide — Configure Syslog Monitoring.
• SignLogger License Activation and Firewall Device Setup Guide — registering the Palo Alto device in SignLogger.