What is Threat ID 9999?
20442
Created On 04/07/22 16:45 PM - Last Modified 08/28/24 06:31 AM
Question
Why is there a threat log entry with the threat ID of 9999?
Environment
Palo Alto Networks firewalls
URL Filtering
Answer
A threat log entry with the threat ID 9999 indicates a security policy match with a URL Filtering profile attached is performing an action other than 'Allow'. For more context, the detailed log view will provide more information about the type of traffic that is triggering this profile.
The ID (9999) is only visible when the URL filtering log is exported or forwarded.
Here's an example of an exported URL filtering log in CSV format.