PaloFilter | Palo Alto Query Builder

Main builder

Filter Builder

Build custom Traffic, Threat, or URL log filters from one or more conditions.

Log type Default join Used for new rows unless a row overrides it. Wrap in NOT

Start with one value

Type: empty

Pick how you want to use the value as a filter.

Conditions

Use row joins and group markers to build filters like A and ( B or C ).

Quick templates

Generated query

Reference fields

The builder uses documented Palo Alto search fields such as addr.src, addr.dst, port.dst, rule, rule_uuid, action, category, url, from, to, and srcuser, plus advanced fields from the Palo Alto log field documentation.

Side-by-side narrowing

Compare 2 to 4 Policies

Generate matching filters for candidate rules so you can compare which policy handled the same flow.

Policy identifier How many policies

Shared context

Optional values here are applied to every candidate policy query.

Source Destination Application Destination port Source zone Destination zone

Allowed versus blocked

Action Compare

Create allow, deny, drop, and blocked-set pivots for the same source, destination, app, port, or rule.

Source Destination Application Destination port Rule name

URL pivot

URL Investigation

Build URL Filtering log searches using exact or partial URL matches, category, rule, and action.

Open Test A Site

URL or domain URL match Known category Rule name Action

URL logs for allowed categories only appear when the relevant profile action is set to log. This section builds the query, but matching results still depend on firewall logging configuration. Built-in PAN-DB categories are normalized to lowercase, while custom URL category names keep the exact case you enter.

Rulebase and profile search

Policy Object Filters

Search configuration objects such as policy names, custom URL category members, URL profiles, and profile groups.

Filter target

These filters are for rulebase, URL category, URL Filtering profile, and security profile group searches. Keep them separate from Monitor log filters because they use configuration paths such as profile-setting/group/member.

Local browser storage

Presets and History

Saved presets and copied-query history stay in this browser only.

Autocomplete Lists

Add your own App-ID or service values. Paste one per line, comma-separated, or space-separated.

Imported applications Imported services or ports

Autocomplete: default lists only

Suggestions appear in application fields and service or port fields. Imported values stay in this browser.

Saved presets

Queries you name and save from the Builder appear here.

Recent queries

Copied generated queries are listed here for quick reuse.