PaloFilter

Main builder

Filter Builder

Log type Join Wrap in NOT

Start with one value

Type: empty

Pick how you want to use the value as a filter.

Conditions

Quick templates

Generated query

Reference fields

The builder uses documented Palo Alto search fields such as addr.src, addr.dst, port.dst, rule, rule_uuid, action, category, misc, from, to, and srcuser, plus advanced fields from the Palo Alto log field documentation.

Side-by-side narrowing

Compare 2 to 4 Policies

Policy identifier How many policies

Shared context

Source Destination Application Destination port Source zone Destination zone

Allowed versus blocked

Action Compare

Source Destination Application Destination port Rule name

URL pivot

URL Investigation

Open Test A Site

URL or domain URL match Known category Rule name Action

URL logs for allowed categories only appear when the relevant profile action is set to log. This section builds the query, but matching results still depend on firewall logging configuration. Built-in PAN-DB categories are normalized to lowercase, while custom URL category names keep the exact case you enter.

Rulebase and profile search

Policy Object Filters

Filter target

These filters are for rulebase, URL category, URL Filtering profile, and security profile group searches. Keep them separate from Monitor log filters because they use configuration paths such as profile-setting/group/member.

Local browser storage