Newly Observed Palo Alto Network Alert

 1[metadata]
 2creation_date = "2026/01/21"
 3integration = ["panw"]
 4maturity = "production"
 5updated_date = "2026/09/18"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10This rule detects Palo Alto Network alerts that are observed for the first time in the previous 5 days of alert history.
11Analysts can use this to prioritize triage and response.
12"""
13from = "now-7205m"
14interval = "5m"
15language = "esql"
16license = "Elastic License v2"
17name = "Newly Observed Palo Alto Network Alert"
18risk_score = 99
19rule_id = "283683eb-f2ce-40a5-be16-fa931cb5f504"
20severity = "critical"
21tags = [
22    "Use Case: Threat Detection",
23    "Rule Type: Higher-Order Rule",
24    "Resources: Investigation Guide",
25    "Domain: Network",
26    "Data Source: PAN-OS",
27    "Noise: Medium",
28    "Performance: Fast",
29    "Rule Type: ES|QL",
30]
31timestamp_override = "event.ingested"
32type = "esql"
33
34query = '''
35FROM logs-panw.panos-*, filebeat-* metadata _id
36
37// exclude Informational and Low severity levels (4 and 5)
38| where data_stream.dataset == "panw.panos" and
39        TO_INTEGER(event.severity) <= 3 and
40        event.action != "flood_detected" and
41        (event.kind IS NULL or event.kind != "metric")
42
43| STATS Esql.alerts_count = count(*),
44        Esql.first_time_seen = MIN(@timestamp),
45        Esql.distinct_count_src_ip = COUNT_DISTINCT(source.ip),
46        Esql.distinct_count_dst_ip = COUNT_DISTINCT(destination.ip),
47        src_ip = VALUES(source.ip),
48        dst_ip = VALUES(destination.ip),
49        url_dom = VALUES(url.domain),
50        url_path = VALUES(url.path) by rule.name, event.action, event.type, event.kind, event.severity
51
52// first time seen is within 10m of the rule execution time within last 5 days
53| eval Esql.recent = DATE_DIFF("minute", Esql.first_time_seen, now())
54| where Esql.recent <= 10 and Esql.alerts_count <= 5 and Esql.distinct_count_src_ip <= 2 and Esql.distinct_count_dst_ip <= 2
55
56// move dynamic fields to ECS quivalent for rule exceptions
57| eval source.ip = MV_FIRST(src_ip),
58       destination.ip = MV_FIRST(dst_ip),
59       url.domain = MV_FIRST(url_dom),
60       url.path = MV_FIRST(url_path)
61| keep rule.name, event.*, Esql.*, source.ip, destination.ip, url.domain, url.path
62'''
63note = """## Triage and analysis
64
65### Investigating Newly Observed Palo Alto Network Alert
66
67This rule surfaces newly observed, low-frequency high severity Palo Alto Network alert within the last 5 days.
68
69Because the alert has not been seen previously for this rule and host, it should be prioritized for validation to determine
70whether it represents a true compromise or rare benign activity.
71
72### Investigation Steps
73
74- Identify the source address, affected host and review the associated rule name to understand the behavior that triggered the alert.
75- Validate the source address under which the activity occurred and assess whether it aligns with normal behavior.
76- Refer to the specific alert details like event.original to get more context.
77
78### False Positive Considerations
79
80- Vulnerability scanners and pentesting.
81- Administrative scripts or automation tools can trigger detections when first introduced.
82- Development or testing environments may produce one-off behaviors that resemble malicious techniques.
83
84### Response and Remediation
85
86- If the activity is confirmed malicious, isolate the affected host to prevent further execution or lateral movement.
87- Terminate malicious processes and remove any dropped files or persistence mechanisms.
88- Collect forensic artifacts to understand initial access and execution flow.
89- Patch or remediate any vulnerabilities or misconfigurations that enabled the behavior.
90- If benign, document the finding and consider tuning or exception handling to reduce future noise.
91- Continue monitoring the host and environment for recurrence of the behavior or related alerts."""
92references = ["https://www.elastic.co/docs/reference/integrations/panw"]