The
Host ID displays in the GlobalProtect logs automatically. For the
Host ID to display in the Traffic, Threat, or Unified logs, the firewall
must have at least one security policy rule with the Source
Device set to Quarantine. Without
this setting in the security policy, Traffic, Threat or Unified
logs will not have the Host ID, and the log forwarding profile will
not take effect.