>
    Strata Copilot
    Strata Logging Service
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. Secure Your AI Models with AI Model Security
    4. Get Started with AI Model Security
    5. Viewing Scan Results
    6. Strata Logging Service
    Download PDF
    Prisma AIRS

    Strata Logging Service

    Table of Contents

    Strata Logging Service

    Each model scan automatically generates a log entry in Strata Logging Service, capturing the scan outcome, model details, and any security violations found.
    Each time AI Model Security scans a model, the result is recorded as a log entry in your tenant's Strata™ Logging Service, capturing the verdict, model details, and any security violations found.
    No configuration is required within Model Security. Entries appear automatically once Strata Logging Service is active on your tenant.
    To get started, enable Strata Logging Service on your tenant. Once active, model security scan entries appear in the Log Viewer alongside your other security logs, where you can search, filter, and export scan activity for monitoring, investigation, and compliance.

    Scan Log Fields

    scan_uuid is the only required field; all others are optional. Enum fields include both a numeric ID and a text label. Use the text label when filtering or displaying results.
    The following fields are logged for each model scan.
    FieldDatatypeDescriptionExample
    scan_uuidStringUnique ID of the scan; use it to correlate with the scan's API record.57d86937-1ba6-4637-b303-87798f555d09
    time_startedStringTimestamp of when the scan started, in UTC using ISO-8601 format.2026-05-07T14:29:58.000Z
    created_byStringID of the user or service account that initiated the scan.9b2e1f44-3c7a-4d61-8a0e-2f5c1d9e7b10
    scan_originEnumChannel used to trigger the scan: SDK (MODEL_SECURITY_SDK), REST API (MODEL_SECURITY_API), or web interface (MODEL_SECURITY_FRONTEND).MODEL_SECURITY_SDK
    source_typeEnumStorage backend the model was pulled from: HUGGING_FACE, S3, GCS, AZURE, LOCAL, ARTIFACTORY, GITLAB.HUGGING_FACE
    eval_outcomeEnumSecurity policy outcome for the scan:
    • ALLOWED — the model passed all rules and is permitted for use.
    • BLOCKED — the model violated one or more rules and is not permitted.
    • ERROR — the scan did not complete successfully and no verdict was reached.
    		BLOCKED
    error_codeEnumSet only when a scan does not complete successfully: RESOURCE_NOT_FOUND, INTERNAL_ERROR, SCAN_DATA_PENDING. Not set when the scan completes successfully.INTERNAL_ERROR
    error_messageStringPlain-language error detail returned when a scan does not complete successfully.Model file not found at source
    total_files_scannedIntegerTotal number of model files evaluated during the scan.12
    total_files_skippedIntegerTotal number of model files skipped during the scan.1
    enabled_rule_countIntegerNumber of security rules active and applied during this scan.8
    rule_passed_countIntegerNumber of security rules the model complied with during the scan.7
    rule_failed_countIntegerNumber of security rules the model did not comply with during the scan.1
    violation_countIntegerTotal number of security violations detected during the scan.2
    security_group_nameStringName of the security group applied to this scan.production-models-sg
    security_group_uuidStringUnique ID of the security group applied to this scan.a1b2c3d4-5678-90ab-cdef-1234567890ab
    labelsStringUser-defined labels on the scan, as a JSON string.{"team":"ml-platform","env":"prod"}
    scanner_versionStringVersion of the model scanning engine.1.0.0
    sdk_versionStringVersion of the client SDK that started the scan.0.9.2
    model_uriStringFull URI of the scanned model, including the storage backend prefix.hf://meta-llama/Llama-2-7b
    model_nameStringName of the scanned model.meta-llama or Llama-2-7b
    model_versionStringRevision or version identifier of the scanned model.main
    model_authorStringAuthor or organization that published the model.meta-llama
    model_formatsList<String>File formats identified in the scanned model.["pickle","safetensors"]
    violationsList<ViolationItem>One entry for each security violation found during the scan. Not present when the scan passes without violations.Each object uses the Violation Log Fields schema.Violation Log Fields

    Violation Log Fields

    The violations field in the scan log contains an array of violation objects. The following fields describe each violation.
    FieldDatatypeDescriptionExample
    rule_nameStringName of the rule that was violated.No unsafe pickle operators
    threatEnumThreat category code, PAIT taxonomy.PAIT-PKL-100
    threat_descriptionStringPlain-language description of the threat category.Pickle model arbitrary code execution at load time
    rule_instance_stateEnumWhether the rule blocks or only warns: DISABLED, ALLOWING, BLOCKING.BLOCKING
    descriptionStringPlain-language details of the specific violation instance.model.pkl uses operator 'exec' which is unsafe.
    file_pathStringPath to the file containing the violation. Not set for violations that apply to the model as a whole.model.pkl
    operatorStringThe unsafe operator or callable detected.exec
    moduleStringModule or framework associated with the violation.pickle
    violation_uuidStringUnique ID of the violation.b1d4e2a0-1111-4c22-9a33-aaaa11112222

    © 2026 Palo Alto Networks, Inc. All rights reserved.