Authentication HTTPS Fields

Table of Contents

Authentication HTTPS Fields

The following table identifies the Authentication field names that the Log Forwarding app uses when you forward logs using the HTTPS log format.

HTTPS Name	Query Name
AuthenticationDescription	auth_description
AuthEvent	auth_event_name.value
AuthFactorNo	auth_factor_num
AuthenticationPolicy	auth_policy
AuthenticationProtocol	auth_proto
AuthServerProfile	auth_server_profile
AuthenticatedUserDomain	authenticated_user_info.domain
AuthenticatedUserName	authenticated_user_info.name
AuthenticatedUserUUID	authenticated_user_info.uuid
ClientType	client_type
ClientTypeName	client_type_name.value
ConfigVersion	config_version.value
CountOfRepeats	count_of_repeats
CortexDataLakeTenantID	customer_id
DGHierarchyLevel1	dg_hier_level_1
DGHierarchyLevel2	dg_hier_level_2
DGHierarchyLevel3	dg_hier_level_3
DGHierarchyLevel4	dg_hier_level_4
IsDuplicateLog	is_dup_log
LogExported	is_exported
LogForwarded	is_forwarded
IsPrismaNetworks	is_prisma_branch
IsPrismaUsers	is_prisma_mobile
Location	location
LogSetting	log_set
LogSource	log_source
LogSourceGroupID	log_source_group_id
DeviceSN	log_source_id
DeviceName	log_source_name
LogSourceTimeZoneOffset	log_source_tz_offset
TimeReceived	log_time
LogType	log_type.value
MFAAuthenticationID	mfa_auth_id
MFAVendor	mfa_vendor
NormalizeUser	normalize_user
Object	object
PanoramaSN	panorama_serial
PlatformType	platform_type
RuleMatched	rule_matched
RuleMatchedUUID	rule_matched_uuid
SequenceNo	sequence_no
AuthCacheServiceRegion	service_region
SessionID	session_id
SourceDeviceCategory	source_device_category
SourceDeviceHost	source_device_host
SourceDeviceMac	source_device_mac
SourceDeviceModel	source_device_model
SourceDeviceOSFamily	source_device_osfamily
SourceDeviceOSVersion	source_device_osversion
SourceDeviceProfile	source_device_profile
SourceDeviceVendor	source_device_vendor
SourceIP	source_ip.value
Subtype	sub_type.value
TimeGenerated	time_generated
TimeGeneratedHighResolution	time_generated_high_res
User	user
UserAgentString	user_agent
VendorName	vendor_name
VirtualLocation	vsys
VirtualSystemID	vsys_id
VirtualSystemName	vsys_name

Authentication EMAIL Fields

Authentication LEEF Fields

Authentication HTTPS Fields

Authentication HTTPS Fields

Recommended For You

Activation and Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Agents & Agentless

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner