Log Subtype says "Deny" Action says "Allow". So two things, did it allow or deny it and two, what is the difference between the Type or subtype and Action column in the Monitor Traffic and Unified?
top of page
All things Palo Alto Networks
Forum: Forum
bottom of page
the 'action' is an indication of what action was taken upon receipt of the first packet (match 6tuple without app) while the subtype is an indication of what happened to the session afterward:
tcp port 443 may be allowed, but application evernote may be blocked, or a threat may be detected, or a faulty certificate,...
the session was first accepted and communication allowed to flow but an event happening later on the session caused a deny action