Japanese (UTF-8) "File Name" will be changed to space or meaningless numbers in data filtering log for boxnet-downloading or web-borwsing
5565
Created On 02/16/23 00:18 AM - Last Modified 01/01/24 23:21 PM
Symptom
For exsample, "PaloaltoぱろあるとTestテスト.xlsx" file name uploaded to some portal sites, the policy enforcement works as expected but Japanese File Name will be garbled in data filtering log like following.
admin@GPGW_587822_ap-northeast-1_nippo> show log data receive_time in last-15-minutes direction equal backward app equal boxnet-downloading Time App From Src Port Source Rule Action To Dst Port Destination Severity Src User Dst User Threat Pcap_id Rule_UUid File Name ========================================================================================== 2023/xx/xx 16:10:42 boxnet-download trust 58600 10.10.0.4 file-upload-test-fo deny untrust 443 xx.xx.xx.xx low user01 ZIP(52004) 0 7b624028-80a4-4a09-ab6c-ad9420eac9ae Paloalto Test .xlsx 2023/xx/xx 16:09:37 boxnet-download trust 58600 10.10.0.4 file-upload-test-fo deny untrust 443 xx.xx.xx.xx low user01 ZIP(52004) 0 7b624028-80a4-4a09-ab6c-ad9420eac9ae Paloalto Test .xlsx admin@GPGW_587822_ap-northeast-1_nippo> show log data receive_time in last-15-minutes direction equal backward app equal web-browsing Time App From Src Port Source Rule Action To Dst Port Destination Severity Src User Dst User Threat Pcap_id Rule_UUid File Name ========================================================================================== 2023/xx/xx 15:32:43 web-browsing trust 52005 10.10.0.4 file-upload-test-fo deny untrust 443 xx.xx.xx.xx low user01 ZIP(52004) 0 7b624028-80a4-4a09-ab6c-ad9420eac9ae 1674455557.822.40031.201129602.xlsx 2023/xx/xx 15:32:37 web-browsing trust 52001 10.10.0.4 file-upload-test-fo deny untrust 443 xx.xx.xx.xx low user01 ZIP(52004) 0 7b624028-80a4-4a09-ab6c-ad9420eac9ae 1674455552.0716.21153.201129601.xlsx
Environment
Prisma Access
Cause
These filenames "Paloalto Test .xlsx" or "1674455557.822.40031.201129602.xlsx" filename is actually retrieved from the payload generated by these portals.
Resolution
This is working as per the current design.