How are the severity and risk related in terms of Palo Alto Threat logs?

[apoorvaa]

How are the severity and risk related in terms of Palo Alto Threat logs?

[btorresgil · Accepted solution]

In a threat log, the severity refers to the threat itself. This can have a high, low, critical, informational severity level, based on the threat itself. The risk refers to the application that the threat is leveraging. So, for example, if the threat is coming over smtp, that is a risk 5 application (high risk), but maybe the severity of the threat was something benign, so the severity is 'informational'. This example indicates a very minimal severity event that took place on a usually high risk application or protocol.

Other log types besides 'threat' (like traffic or url logs) will still have a risk related to the application in those logs, but because there is no threat referenced in these log types, there will not be a severity.

The new Palo Alto Networks App version 5.0 and Add-on clarify this distinction by prefixing the field names. The new field names are app:risk and threat:severity.

If you decide to upgrade, please use the upgrade guide to migrate to App version 5.0:
http://pansplunk.readthedocs.org/en/latest/upgrade.html