Scan Event LEEF Fields

Table of Contents

Scan Event LEEF Fields

The following table identifies the Scan Event field names that the Log Forwarding app uses when you forward logs using the LEEF log format.

When you create a syslog forwarding profile , you can optionally create a profile token that the Log Forwarding app uses when it sends logs to the syslog server. If you configure a profile token, it appears in the log line immediately after the log type information (for example, TRAFFIC, THREAT, HIPMATCH, and so forth). The token will appear on a parameter called profileToken.

LEEF Name	Query Name	Field Type
CreatedBy	created_by	Custom
CortexDataLakeTenantID	customer_id	Custom
EnabledRuleCount	enabled_rule_count	Custom
ErrorCode	error_code.value	Custom
ErrorMessage	error_message	Custom
EvalOutcome	eval_outcome.value	Custom
Labels	labels	Custom
LogSource	log_source	Custom
LogSourceGroupID	log_source_group_id	Custom
DeviceSN	log_source_id	Custom
DeviceName	log_source_name	Custom
LogSourceTimeZoneOffset	log_source_tz_offset	Custom
TimeReceived	log_time	Custom
cat	log_type.value	Predefined
ModelAuthor	model_author	Custom
ModelFormats	model_formats	Custom
ModelName	model_name	Custom
ModelURI	model_uri	Custom
ModelVersion	model_version	Custom
PlatformType	platform_type	Custom
RuleFailedCount	rule_failed_count	Custom
RulePassedCount	rule_passed_count	Custom
ScanOrigin	scan_origin.value	Custom
ScanUUID	scan_uuid	Custom
ScannerVersion	scanner_version	Custom
SDKVersion	sdk_version	Custom
SecurityGroupName	security_group_name	Custom
SecurityGroupUUID	security_group_uuid	Custom
SourceType	source_type.value	Custom
SubType	sub_type.value	Custom
devTime	time_generated	Predefined
TimeGeneratedHighResolution	time_generated_high_res	Custom
TimeStarted	time_started	Custom
TotalFilesScanned	total_files_scanned	Custom
TotalFilesSkipped	total_files_skipped	Custom
TSGID	tsg_id	Custom
Vendor	vendor_name	Header
ViolationCount	violation_count	Custom
Violations	violations	Custom

Scan Event HTTPS Fields

Cloud Identity Engine Logs

Strata Logging Service Docs

Scan Event LEEF Fields

Strata Logging Service Docs

Scan Event LEEF Fields

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner