Go Up

Object Types and Attributes Monitored on PaloAlto Devices

Review a full list of object types Netwrix Auditor can collect on PaloAlto network devices.

Object type Actions Event ID

Logon

  • Successful logon
  • logged in

  • Failed logon
  • failed authentication for user
  • authentication failed for user

Authentication

  • Successful Logon
  • authentication succeeded for user
  • USERID,login,

  • globalprotectportal-auth-succ
  • Failed Logon
  • authentication failed for user
  • globalprotectportal-auth-fail

Configuration

  • Modified / Modify (Failed attempt)
  • commit

Environment

  • Read / Read (Failed attempt)
  • connect-server-monitor-failure

Session

  • Logoff
  • logged out

User

  • Add / Added (Failed attempt)
  • config mgt-config users
  • config shared local-user-database user

  • Modified / Modify (Failed attempt)
  • config mgt-config users
  • config shared local-user-database user

  • Removed / Remove (Failed attempt)
  • config mgt-config users
  • config shared local-user-database user

Go Up