Your firewall's URL filtering logs already record every AI SaaS connection, tagged with the source user when User-ID runs. This guide covers both export shapes, CSV and key=value syslog, and what a manufacturer found in theirs.
Palo Alto shops usually have both paths available. The audit parses either without configuration, so pick the one that costs you less effort.
Either way, three fields carry the audit: the hostname or URL, the source user, and the timestamp. Everything else in a THREAT/url line is welcome ballast.
Palo Alto's key=value style looks noisy until you know which four keys matter. Here is a realistic slice with the noise dimmed.
misc=Carries the URL in url-type THREAT logs. The parser extracts the hostname and ignores the path.src_user=The User-ID mapped identity. Present: per-user table. Absent: the src IP stands in as the source.action=alert means allowed-and-logged, block-url means stopped. Keep both kinds for policy evidence.category=PAN-DB's opinion. Ignored by matching, interesting to compare with the audit's verdict afterwards.The parser reads key=value pairs natively, in any order, with any surrounding syslog header. Concatenate days together, mix devices, and it still resolves each line to hostname plus identity.
Line one and three are the same user hitting a CAD-adjacent AI domain and its API subdomain. Subdomain walk-up folds both into one tool with two hostnames, which is exactly how the scenario below started.
A 900-person industrial manufacturer, PA firewalls at the plant and HQ, User-ID on the office segments. Sample data; the shift-log format tells it best.
A design lead mentions a "great new AI render plugin" in a stand-up. Nobody procured one. IT decides to audit rather than interrogate.
Thirty days of URL-filtering syslog from the collector: 240,000 lines across both sites. Uploaded as-is, key=value parsed automatically, full report tier.
28 AI tools. The headline is not the chatbots: it is a CAD-adjacent AI mesh-processing SaaS with 11 users in the plant design group, plus its API subdomain moving steady traffic during render jobs.
The tool's register entry shows training terms not stated and a high data-sovereignty flag. Proprietary part geometry has been leaving the building.
Design gets a sanctioned alternative with contractual no-training terms within a week, because the report gave procurement a dated, specific case instead of a vague worry.
The consumer domain moves to a block rule. The plugin's users get a migration note, not a reprimand.
Re-run on the same window length: the blocked domain shows attempts trending to zero, and the sanctioned alternative shows the same 11 users. The two PDFs together document the whole arc for the ISO auditor.
Manufacturing networks rarely have User-ID everywhere. The audit degrades gracefully instead of failing.
AD-joined desktops carry src_user on every line. The per-user table reads like an org chart, and coaching conversations have names.
Shared terminals and OT segments log bare source IPs. The audit treats each IP as a source, so you still see which stations reach AI tools and how hard.
Guest ranges aggregate into a handful of NAT IPs. Read those rows as "the guest network does this much AI", which is a policy fact on its own.
Mixed exports are fine: lines with src_user and lines without coexist in one upload, and the per-user table simply shows both kinds of source.
| Report section | With a PA URL log |
|---|---|
| Summary tiles | Full totals: tools, high-risk, training exposure, abusive-purpose, unsanctioned. |
| Tool table | Every matched tool with category, risk, sovereignty, dated training verdict, policy verdict. |
| Per-user breakdown | src_user identities where User-ID runs; source IPs elsewhere. Both count as sources. |
| Blocked vs allowed | action=alert vs block-url rows keep enforcement evidence visible. |
| Sanctioned split | Your approved list against observed traffic, per tool. |
| CSV + PDF | Full-report tier: machine-readable table plus the evidence pack. |
The syslog slice is read once and discarded after matching. Only hostnames and identities appear in the report; paths in misc= fields never do. Reports live 90 days, deletable earlier.
Open the sample evidence pack: tiles, the tool table with training verdicts, the per-source breakdown. Three pages of sample data, no signup.
The report's block list becomes a custom URL category; the control list becomes procurement tickets. Then one re-run proves both.
Load block-verdict domains from the report CSV into a custom category attached to a deny rule. The abusive-purpose tools go first, and the change ticket cites the report's dated verdicts.
Control-verdict tools with real user counts justify enterprise tiers. The manufacturer's CAD case closed in a week because the report quantified who needed what.
Next month, same window: blocked domains should show block-url actions only. Anything still alerting means a rule ordering issue or a bypass path, both worth finding early.
Monthly loops fit plan allowances; one-off engagements fit packs. Both on the pricing page. The audit-first sequencing argument lives on detect before you block.
URL filtering logs, as console CSV or key=value syslog. Traffic logs work too when they carry hostnames, but URL logs are the natural fit.
No. The parser skips syslog prefixes and reads the key=value pairs wherever they sit on the line, mixed devices included.
Lines with src_user map to users; lines without map to source IPs. Both appear as sources, and the tool inventory is identical either way.
No. Export the aggregated URL log slice from wherever it lives; the line format is what matters, not the path it took.
Yes. block-url rows show your policy working, and attempts against blocked AI domains show demand you may want to answer with a sanctioned tool.
The audit adds per-tool risk levels, dated training verdicts, sovereignty and abusive flags, and a sanctioned split, none of which a URL category can express.
URL logs are mid-weight: heavier than DNS, lighter than full proxy transactions. Planning numbers by deployment.
A month of URL logs typically stays in the low hundreds of thousands of lines. One full report, no trimming.
Concatenated slices from several devices still fit the 2,000,000-line cap for a 30-day window in most mid-size fleets.
Audit per region, or cut to two weeks. For whole-quarter single runs, ask us; larger exports are handled on request.
Cheapest size cut: export url-type THREAT logs only, skip traffic logs entirely. Second cheapest: pre-filter to action=alert if you only need exposure, though keeping blocks preserves the enforcement story.
Firewall teams sit in quarterly security reviews anyway. These three report numbers slot straight into that agenda.
Office vs plant vs guest, using the identity shapes from the mixed User-ID coverage. It shows where policy attention actually belongs, instead of treating the network as one blob.
For manufacturers with export-controlled designs, tools flagged high data-sovereignty are the row legal asks about. The dated verdict makes the answer fileable.
Rising attempt counts on blocked AI domains mean demand without an outlet. That is a procurement signal, and it is cheaper to answer it than to keep policing it.
Pull thirty days of URL logs and see the free totals today. The manufacturer's CAD discovery came from a routine slice just like it.
Run the free audit