Torrent Website Access Detected
Detects users successfully accessing peer-to-peer (P2P) or torrent websites through the network where the Palo Alto firewall generated an alert but did not block the traffic.
CQL · Falcon Next-Gen SIEMCopy query
#Vendor = paloalto
event.action = url_filtering
| Vendor.Action != "block-url"
| Vendor.Action != "block-url-continue"
| Vendor.Action != "deny"
| (Vendor.URLCategoryList = /peer-to-peer/i OR Vendor.Category = /peer-to-peer/i)
| event.category[1] = threat
| Vendor.ApplicationTechnology = "browser-based"
| "Vendor.application_category" != "general-internet"
| groupBy([url.domain, url.original, source.user.name, source.ip, source.nat.ip, rule.name, Vendor.Action], function=[
count(as=event_count)
])
| sort(event_count, order=desc)torrent_website_access_detected.yml
Mahfuz
Detection
Network
2026-05-08
2026-05-08
