>
    Strata Copilot
    Directory sync EMAIL Fields
    Focus
    Download PDF
    Focus
    1. Home
    2. Strata Logging Service
    3. Strata Logging Service Log Reference
    4. Cloud Identity Engine Logs
    5. Directory sync
    6. Directory sync EMAIL Fields
    Download PDF
    Strata Logging Service

    Directory sync EMAIL Fields

    Table of Contents

    Directory sync EMAIL Fields

    The following table identifies the Directory sync field names that the Log Forwarding app uses when you forward logs using the EMAIL log format.
    EMAIL Name
    Query Name
    TimeReceived
    cie_log_time
    ClientApplicationId
    client_application_id
    Count
    count
    CountSummaryApplication
    count_summary.​application
    CountSummaryComputer
    count_summary.​computer
    CountSummaryContainer
    count_summary.​container
    CountSummaryGroup
    count_summary.​group
    CountSummaryOU
    count_summary.​ou
    CountSummar RoleAssignments
    count_summary.​roleassignments
    CountSummaryUser
    count_summary.​user
    CortexDataLakeTenantId
    customer_id
    DirectoryId
    directory_id
    DirectoryName
    directory_name
    DirectoryType
    directory_type
    EventCategory
    event_category
    EventSequenceId
    event_sequence_id
    EventState
    event_state
    EventType
    event_type
    FailureReasonCode
    failure_reason_code
    FlattenedMembershipCountCIE
    flattened_membership_count_cie
    FlattenedMembershipCountCIEPreviousSync
    flattened_membership_count_cie_previous_sync
    FlattenedMembershipCountIDP
    flattened_membership_count_idp
    ImmediateMembershipCountCIE
    immediate_membership_count_cie
    ImmediateMembershipCountCIEPreviousSync
    immediate_membership_count_cie_previous_sync
    ImmediateMembershipCountIDP
    immediate_membership_count_idp
    LogSource
    log_source
    LogSourceGroupID
    log_source_group_id
    DeviceSN
    log_source_id
    DeviceName
    log_source_name
    LogSourceTimeZoneOffset
    log_source_tz_offset
    TimeReceived
    log_time
    LogType
    log_type.​value
    PlatformType
    platform_type
    RecommendedAction
    recommended_action
    SourceId
    source_id
    SourceType
    source_type
    SubType
    sub_type.​value
    SyncJobId
    sync_job_id
    SyncType
    sync_type
    TargetId
    target_id
    TargetType
    target_type
    TimeGenerated
    time_generated
    TimeGeneratedHighResolution
    time_generated_high_res
    TSGID
    tsg_id
    VendorName
    vendor_name

    © 2026 Palo Alto Networks, Inc. All rights reserved.