Monitoring is the way a Palo Alto Networks firewall tells you what it saw, what it blocked, and why. Without monitoring, you have a firewall but no idea if it is actually protecting your network. For the PCNSA exam, you need to know how to read the firewall's logs, use its dashboards, and create simple reports so you can answer the most basic question: "Is our network safe right now?"
Jump to a section
A simple way to picture Monitoring: Log Types, Dashboards, and Basic Reports
Your local coffee shop, busy during the morning rush. The owner has installed a security camera inside the shop, one over the front door, and another pointed at the alley entrance.
The camera feed is not just one video stream. Each camera records different things. The front-door camera shows every person entering and leaving, the time they arrive, and if they are carrying a laptop bag. This is like a traffic log, recording every connection that crosses the firewall. The alley camera might capture suspicious behaviour, like someone testing the lock on the back door. This is a threat log, recording attempted intrusions. The camera over the counter sees every customer order, the drink they buy, and whether they used a loyalty card. This is like a URL filtering log, showing what websites users are visiting and if the request was allowed.
The owner does not watch the live feed all day. Instead, they check the dashboard, a single screen that shows key information: the number of people in the shop, the busiest hour, and how many times the back door was accessed in the last 24 hours. When the owner needs to see if a specific person entered on Tuesday morning, they generate a basic report. They scroll through the recorded video from that camera at that time. This is exactly what a network security administrator does: use different logs for different purposes, glance at a dashboard for a summary, and run a report to investigate an incident or check compliance.
A Palo Alto Networks firewall is like a security guard at a gate. It checks every single piece of data, or packet, that tries to enter or leave the network. But the guard does not just wave packets through. It writes down everything: who sent the packet, where it was going, what kind of data it was, and whether the guard let it pass or stopped it. These written records are called logs.
There are three main types of logs you need to know for the PCNSA exam: traffic logs, threat logs, and URL filtering logs.
A traffic log is a record of every connection that the firewall saw. Think of it as a guestbook. It shows the source IP address (who sent it), the destination IP address (where it was going), the port number (like a door number on a building that tells you what service is being used, such as port 80 for web traffic), and the action the firewall took (allow or deny). Traffic logs are the most common log type and they answer the question "Did this connection happen?"
A threat log is recorded when the firewall detects something dangerous. The firewall uses special rules called security policies and a database of known threats called signatures to decide if a packet is malicious. A threat log includes the same information as a traffic log plus the type of threat, such as a virus (malware), a probe to find open ports, or a command and control attempt from malware that is already inside. Threat logs answer the question "Was this connection dangerous?"
A URL filtering log is created when a user on the network visits a website. The firewall checks the website's web category, such as "Social Media" or "Malware", against your URL filtering policy. The log shows the site's URL, the user who visited it, the category the firewall assigned, and whether the firewall allowed or blocked the action. These logs answer the question "What websites are people visiting?"
Dashboards are a way to see a summary of all this log data on a single screen, without digging through individual logs. The firewall dashboard shows graphs and counters. You might see a graph of traffic over the last hour, a list of the top users sending the most traffic, or a pie chart showing the most common threat types. The dashboard is designed for a quick health check.
Basic reports allow you to extract specific information from the logs for a certain time period. For example, you could create a report to show all blocked traffic in the last week, or all visits to the "Social Media" category on a specific day. Reports are used for deeper investigation and for proving compliance with security policies to auditors or management.
Log into the firewall management interface
Open your web browser and enter the IP address of the Palo Alto Networks firewall management port. You will see a login screen. Enter your administrator username and password. This interface is the central place to view logs, dashboards, and reports.
Open the Dashboard
After logging in, you will see the dashboard by default or you can click 'Dashboard' in the top menu. Look at the widgets: 'Top Applications', 'Threats Over Time', 'Traffic Volume'. These give you a snapshot of what is happening on the network right now. If you see a spike in threats, you know to investigate the threat log next.
Navigate to the traffic log
Click on the 'Monitor' tab, then select 'Logs' and 'Traffic'. The traffic log shows a table with columns for time, source IP, destination IP, port, and action. Use the filter bar at the top to narrow results. For example, set the 'Action' filter to 'deny' to see only blocked connections.
Inspect a specific traffic log entry
Click on any row in the traffic log table. A details window opens showing more information: the application used (e.g., 'SSL'), the threat category (if any), the user who initiated the session, and the security rule that was matched. This helps you understand why the firewall allowed or denied the connection.
Switch to the threat log
Still in the 'Monitor' tab, select 'Logs' and 'Threat'. This log only shows events where a threat signature matched. Look at the 'Severity' column (critical, high, medium, low) and the 'Threat ID' which tells you the specific vulnerability or malware detected. Use filters to zero in on high-severity threats.
Generate a basic report
Click on 'Reports' in the 'Monitor' tab, then 'Create' and choose a report template like 'Traffic Summary'. Set the time range (e.g., last 7 days), select the columns you want (source, destination, action), and click 'Generate'. The report will appear in a table format that you can export to PDF or CSV for sharing with your team or a compliance auditor.
Imagine you are the network administrator for a small marketing company with 50 employees. One morning, the finance director tells you that the accounting database server seems slow. You need to find out if something is attacking the server or if someone inside the network is causing a problem.
You log into the Palo Alto Networks firewall management interface. You start by looking at the dashboard. On the dashboard, you see a widget showing the top applications by traffic volume. You notice that an application called "SQL Server" has a massive spike in traffic over the last 30 minutes. That is unusual because the accounting server should only see a few queries per minute from the accounting team.
Now you need to investigate the details. You navigate to the traffic log. You set filters in the log viewer:
Source IP: any (because you do not know who started it)
Destination IP: the IP address of the accounting server
Time range: last 30 minutes
You see dozens of entries. Each entry shows a different source IP address from an external country. One of the IP addresses is from a country where the company has no clients. The service column says "TCP/21" which is the port for FTP, not SQL. This is clearly a port scan, a threat where an attacker probes for open services.
You then switch to the threat log to see if the firewall blocked any malicious payloads. You filter the threat log for the same destination IP and find multiple entries marked "Vulnerability Attempt" for a service called "SQL Injection". The firewall blocked them all because the URL filtering profile blocked the SQL commands. You also check the URL filtering log to see if any internal users accidentally visited a phishing link. You filter the URL filtering log by user, find the finance director's username, and see that he visited a site categorised as "Newly Registered Domain" just before the attack started. That site was the source of the malware that established a command and control channel.
In a real business, you would use the dashboard for daily health checks, the traffic log to investigate performance issues, the threat log to confirm attacks, and the URL filtering log to trace user activity. You would then create a report summarising these findings (traffic, threats, and visited URLs) for the finance director to show what happened and why the firewall is necessary.
The PCNSA exam tests your ability to distinguish between the three main log types and know when to use each one. You will see scenario-based questions where you are given a problem (like "A user cannot access a website") and you must choose which log to check first.
Common exam traps:
A question asks: "Which log type would you use to see if a file was flagged as malware?" The correct answer is the threat log. Do not pick the traffic log, because the traffic log only tells you a connection was made, not that a file inside it was dangerous.
A question asks: "Which log type would you use to see what website categories a specific user visited yesterday?" The correct answer is the URL filtering log. The traffic log does not contain the website category, only the IP address.
The exam loves to test the difference between "allow" and "deny" actions within a single log type. If a question asks "How can you see all the connections that the firewall blocked?", you need to know that both traffic and threat logs can show blocked actions. The trap is that beginners think only the threat log shows blocks. Actually, the traffic log also shows blocks if the security policy explicitly denied the connection.
Key definitions to memorise:
Traffic log: records every session (connection) that the firewall processes.
Threat log: records only sessions that matched a threat signature.
URL filtering log: records every URL request that was inspected by the firewall's URL filtering profile.
Dashboard: a pre-built summary view of logs, with widgets showing top users, top threats, traffic volume, etc.
Report: a customised extraction of log data, often used for compliance audits.
Common exam question formats:
Multiple choice: "Which log type contains information about a malicious file transfer?" (Threat log)
Multiple choice: "You want to see a real-time overview of network traffic. What should you use?" (Dashboard)
Drag and drop: Match the log type to the description (e.g., "Contains protocol and port information" = Traffic log).
True/False: "The URL filtering log can show you the application name associated with a connection." (False, because URL filtering logs show URLs, not application names. Traffic logs show applications.)
The exam also expects you to know that logs can be filtered by time, source, destination, action, and user. You will not be asked to build a report from scratch, but you will need to know what data you can include in a report (such as specific log columns) and why you would generate one (for compliance or incident response).
The traffic log records every session the firewall processes, showing source, destination, port, and whether the action was allow or deny.
The threat log only records sessions that matched a threat signature, including details about the malware, vulnerability, or command-and-control attempt.
The URL filtering log records website requests that were inspected by the URL filtering profile, including the visited URL and its web category.
The dashboard provides a pre-built summary of log data, such as top users, top threats, and traffic volume, and is the first place to look for a quick health check.
A basic report extracts specific log data for a defined time period and is used for compliance audits or detailed incident investigations.
Always check the dashboard before diving into logs, as it highlights anomalies that tell you which log type to investigate first.
The action field (allow or deny) exists in traffic, threat, and URL filtering logs, so a connection that was blocked can appear in multiple logs depending on the trigger.
Without SSL Decryption, the URL filtering log cannot show the full URL for HTTPS websites; it only shows the server IP address and the application name.
These come up on the exam all the time. Here's how to tell them apart.
Traffic Log
Records every single session (connection) the firewall processes.
Includes allow and deny actions for normal traffic.
Columns focus on session metadata: source, destination, port, protocol.
Threat Log
Records only sessions that matched a threat signature.
Includes the specific threat ID, severity, and malware filename (if applicable).
Columns focus on threat details: vulnerability name, action taken (alert/block), and packet capture data.
Traffic Log
Shows the application used (e.g., web-browsing, email, FTP).
Does not show the specific URL visited.
Logged for all traffic, regardless of URL filtering policy.
URL Filtering Log
Shows the exact URL (e.g., www.example.com/login.php).
Shows the web category assigned by the firewall (e.g., 'Social Media', 'Malware').
Only logged for HTTP and HTTPS traffic that is inspected by the URL filtering profile.
Dashboard
Shows real-time summary data on a single screen.
Cannot be customised beyond widget selection.
Intended for immediate situational awareness.
Basic Report
Extracts specific log data for a defined time period.
Can be customised by choosing columns, filters, and sorting.
Intended for deep investigation, compliance proof, or sharing with others.
Monitor Tab
Used to view live logs and the dashboard in real time.
Supports filtering, sorting, and searching of current log data.
Does not generate saved output files.
Reports Tab
Used to create, run, and save pre-configured or custom reports.
Supports scheduling reports (e.g., daily email delivery).
Output can be exported to PDF, CSV, or HTML.
Mistake
All log types contain the same information; the only difference is the name.
Correct
Traffic logs contain session metadata (source, destination, port, action). Threat logs contain threat signature details and malware info. URL filtering logs contain the visited URL and the web category. They are fundamentally different.
New users see the log viewer in the firewall GUI and think all columns look similar, so they assume the data is the same. The column names are often similar, but the data only appears in one log type based on the event that triggered it.
Mistake
If the traffic log shows a connection was 'denied', I do not need to check the threat log because the threat log only shows allowed connections.
Correct
The threat log shows both allowed and denied connections that matched a threat signature. If a threat is detected but the security policy allows it, the threat log shows it with an 'allow' action. Denied threats appear in both the traffic log and the threat log.
People think threat logs are only for malicious activity that was blocked, but the firewall can also alert on threats without blocking them if the policy is set to 'alert' mode. This is a common configuration for fine-tuning security rules.
Mistake
The dashboard is just a visual version of the traffic log, so I should never use it for troubleshooting.
Correct
The dashboard shows aggregated data (sums, averages, top-N lists) from all log types. It is invaluable for spotting anomalies quickly, like a sudden spike in traffic or a new top application, which point you to the right log for deeper investigation.
Beginners think dashboards are only for management eye candy. In reality, seasoned administrators use dashboards first to get a high-level overview, then drill down into logs. The exam tests this workflow.
Mistake
The URL filtering log will show me every single website request, including HTTPS traffic.
Correct
The URL filtering log only shows requests that were inspected by the firewall's URL filtering profile. For HTTPS traffic, the firewall can inspect the URL only if it decrypts the SSL/TLS traffic (using a feature called SSL Decryption). Without decryption, the URL filtering log shows the IP address and the application, but not the specific URL.
Users assume the firewall can always see the full URL because the browser shows it. They do not understand SSL/TLS encryption hides the URL path from network equipment unless decryption is configured. The exam tests this nuance.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A traffic log records every single network connection the firewall processed, showing whether it was allowed or denied. A threat log only records connections that matched a known threat signature, such as malware or an exploit attempt.
Go to the URL filtering log under Monitor > Logs > URL Filtering. Filter the 'Action' column to 'block' or 'override' to see only the URL requests that were denied by your URL filtering policy.
The dashboard shows aggregated summaries, like total traffic volume or top threat types, but it does not show individual log entries. To see the raw data, you must open the specific log type (traffic, threat, or URL filtering).
A basic report is a customised extraction of log data for a specific time period, used for deep investigation or compliance reporting. A dashboard gives a real-time overview on a single screen. Reports can be saved and exported; dashboards cannot.
Check the URL filtering log for that session. The firewall might have allowed the network connection but blocked the actual URL request because of a URL filtering policy (such as blocking the 'Social Media' category).
Without SSL Decryption, the firewall cannot see the encrypted URL inside the HTTPS tunnel. It only sees the server's IP address and the application (HTTPS). To see the full URL, you need to enable SSL Decryption on the firewall.
You've finished Monitoring: Log Types, Dashboards, and Basic Reports. Continue through the PCNSA study guide to build a complete picture of the exam.
Done with this chapter?