> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-firewall-eal-logs.md). # Palo Alto Networks Firewall EAL Logs Alerts related to data source "Palo Alto Networks Firewall EAL Logs". | Alert | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [A rare FTP user has been detected on an existing FTP server](/analytics-alerts/alerts-by-name/a-rare-ftp-user-has-been-detected-on-an-existing-ftp-server.md) | | [A user accessed an uncommon AppID](/analytics-alerts/alerts-by-name/a-user-accessed-an-uncommon-appid.md) | | [A user accessed multiple time-consuming websites](/analytics-alerts/alerts-by-name/a-user-accessed-multiple-time-consuming-websites.md) | | [Abnormal communication with a rare combination of TLS and HTTP User Agent](/analytics-alerts/alerts-by-name/abnormal-communication-with-a-rare-combination-of-tls-and-http-user-agent.md) | | [Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server](/analytics-alerts/alerts-by-name/abnormal-network-communication-with-a-rare-combination-of-http-user-agent-and-http-server.md) | | [Abnormal RPC traffic to multiple hosts](/analytics-alerts/alerts-by-name/abnormal-rpc-traffic-to-multiple-hosts.md) | | [Abnormal sensitive RPC traffic to multiple hosts](/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts.md) | | [Abnormal sensitive RPC traffic to multiple hosts from a rarely seen host](/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts-from-a-rarely-seen-host.md) | | [Bronze-Bit exploit](/analytics-alerts/alerts-by-name/bronze-bit-exploit.md) | | [DNS Tunneling](/analytics-alerts/alerts-by-name/dns-tunneling.md) | | [Failed DNS](/analytics-alerts/alerts-by-name/failed-dns.md) | | [Failed Login For a Long Username With Special Characters](/analytics-alerts/alerts-by-name/failed-login-for-a-long-username-with-special-characters.md) | | [FTP Connection Using an Anonymous Login or Default Credentials](/analytics-alerts/alerts-by-name/ftp-connection-using-an-anonymous-login-or-default-credentials.md) | | [HTTP with suspicious characteristics](/analytics-alerts/alerts-by-name/http-with-suspicious-characteristics.md) | | [Increase in Job-Related Site Visits](/analytics-alerts/alerts-by-name/increase-in-job-related-site-visits.md) | | [Massive upload to a rare storage or mail domain](/analytics-alerts/alerts-by-name/massive-upload-to-a-rare-storage-or-mail-domain.md) | | [Multiple Suspicious FTP Login Attempts](/analytics-alerts/alerts-by-name/multiple-suspicious-ftp-login-attempts.md) | | [Multiple uncommon SSH Servers with the same Server host key](/analytics-alerts/alerts-by-name/multiple-uncommon-ssh-servers-with-the-same-server-host-key.md) | | [Possible path traversal via HTTP request](/analytics-alerts/alerts-by-name/possible-path-traversal-via-http-request.md) | | [Random-Looking Domain Names](/analytics-alerts/alerts-by-name/random-looking-domain-names.md) | | [Rare access to known advertising domains](/analytics-alerts/alerts-by-name/rare-access-to-known-advertising-domains.md) | | [Rare DCOM RPC activity](/analytics-alerts/alerts-by-name/rare-dcom-rpc-activity.md) | | [Rare LDAP enumeration](/analytics-alerts/alerts-by-name/rare-ldap-enumeration.md) | | [Rare MS-Update Server was detected](/analytics-alerts/alerts-by-name/rare-ms-update-server-was-detected.md) | | [Rare MS-Update traffic over HTTP](/analytics-alerts/alerts-by-name/rare-ms-update-traffic-over-http.md) | | [Rare NTLM Usage by User](/analytics-alerts/alerts-by-name/rare-ntlm-usage-by-user.md) | | [Rare Remote Service (SVCCTL) RPC activity](/analytics-alerts/alerts-by-name/rare-remote-service-svcctl-rpc-activity.md) | | [Rare Scheduled Task RPC activity](/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity.md) | | [Rare Scheduled Task RPC activity from a rarely seen host](/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity-from-a-rarely-seen-host.md) | | [Rare Windows Remote Management (WinRM) HTTP Activity](/analytics-alerts/alerts-by-name/rare-windows-remote-management-winrm-http-activity.md) | | [Recurring access to rare domain](/analytics-alerts/alerts-by-name/recurring-access-to-rare-domain.md) | | [Subdomain Fuzzing](/analytics-alerts/alerts-by-name/subdomain-fuzzing.md) | | [Suspicious Encrypting File System Remote call (EFSRPC) to domain controller](/analytics-alerts/alerts-by-name/suspicious-encrypting-file-system-remote-call-efsrpc-to-domain-controller.md) | | [Suspicious failed HTTP request - potential Spring4Shell exploit](/analytics-alerts/alerts-by-name/suspicious-failed-http-request-potential-spring4shell-exploit.md) | | [Suspicious HTTP parameters detected](/analytics-alerts/alerts-by-name/suspicious-http-parameters-detected.md) | | [Suspicious ICMP packet](/analytics-alerts/alerts-by-name/suspicious-icmp-packet.md) | | [Suspicious NTLM authentication with machine account](/analytics-alerts/alerts-by-name/suspicious-ntlm-authentication-with-machine-account.md) | | [Suspicious SSH Downgrade](/analytics-alerts/alerts-by-name/suspicious-ssh-downgrade.md) | | [Uncommon WPAD queries](/analytics-alerts/alerts-by-name/uncommon-wpad-queries.md) | | [Unique client computer model was detected via MS-Update protocol](/analytics-alerts/alerts-by-name/unique-client-computer-model-was-detected-via-ms-update-protocol.md) | | [Unusual ADFS Remote Synchronization network connections from non-ADFS server](/analytics-alerts/alerts-by-name/unusual-adfs-remote-synchronization-network-connections-from-non-adfs-server.md) | | [Weakly-Encrypted Kerberos TGT Response](/analytics-alerts/alerts-by-name/weakly-encrypted-kerberos-tgt-response.md) | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-firewall-eal-logs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.