PaloFilter

Main builder

Filter Builder

Log type Join Wrap in NOT

Start with one value

Type: empty

Pick how you want to use the value as a filter.

Conditions

Quick templates

Generated query

Reference fields in v1

The builder uses documented Palo Alto search fields such as addr.src, addr.dst, port.dst, rule, rule_uuid, action, category, url, from, to, and srcuser.

Side-by-side narrowing

Compare 2 to 4 Policies

Policy identifier How many policies

Shared context

Source Destination Application Destination port Source zone Destination zone

Allowed versus blocked

Action Compare

Source Destination Application Destination port Rule name

URL pivot

URL Investigation

Open Test A Site

URL or domain Known category Rule name Action

URL logs for allowed categories only appear when the relevant profile action is set to log. This section builds the query, but matching results still depend on firewall logging configuration.

Local browser storage