Events HTTPS Fields

Table of Contents

Events HTTPS Fields

The following table identifies the Events field names that the Log Forwarding app uses when you forward logs using the HTTPS log format.

HTTPS Name	Query Name	Field Type
ApplicationAppCategory	application.app_category	string
ApplicationAppSubcategory	application.app_sub_category	string
ApplicationExternalID	application.external_id	string
ApplicationExternalName	application.external_name	string
ApplicationID	application.id	string
ApplicationName	application.name	string
ApplicationProtectedAccount	application.protected_account	boolean
ApplicationRiskOfApp	application.risk_of_app	int
ApplicationSource	application.source	string
ApplicationUsername	application.username	string
BatchID	batch_id	string
BrowserExtensionAppLaunchURL	browser_extension.app_launch_url	string
BrowserExtensionAvailableLaunchTypes	browser_extension.available_launch_types	array
BrowserExtensionDescription	browser_extension.description	string
BrowserExtensionDisabledReason	browser_extension.disabled_reason	string
BrowserExtensionEnabled	browser_extension.enabled	boolean
BrowserExtensionHomepageURL	browser_extension.homepage_url	string
BrowserExtensionHostPermissions	browser_extension.host_permissions	array
BrowserExtensionID	browser_extension.id	string
BrowserExtensionInstallType	browser_extension.install_type	string
BrowserExtensionIsApp	browser_extension.is_app	boolean
BrowserExtensionLaunchType	browser_extension.launch_type	string
BrowserExtensionMayDisable	browser_extension.may_disable	boolean
BrowserExtensionName	browser_extension.name	string
BrowserExtensionOfflineEnabled	browser_extension.offline_enabled	boolean
BrowserExtensionOptionsURL	browser_extension.options_url	string
BrowserExtensionPermissions	browser_extension.permissions	array
BrowserExtensionShortName	browser_extension.short_name	string
BrowserExtensionType	browser_extension.type	string
BrowserExtensionUpdateURL	browser_extension.update_url	string
BrowserExtensionVersion	browser_extension.version	string
CertificateCreatedTime	certificate.created_time	timestamp
CertificateExpirationTime	certificate.expiration_time	timestamp
CertificateFingerprints	certificate.fingerprints	array
CertificateIssuer	certificate.issuer	string
CertificateSerialNumber	certificate.serial_number	string
CertificateSubject	certificate.subject	string
ClassificationCategory	classification.category	string
ClassificationMaliciousCategories	classification.malicious_categories	array
ClassificationMITRE	classification.mitre	array
ClassificationReputation	classification.reputation	long
ClassificationSecurityCompliance	classification.security_compliance	array
ClassificationSeverity	classification.severity	string
ClipboardFromURL	clipboard.from_url	string
ClipboardSelectedElement	clipboard.selected_element	string
ContentCategories	content.categories	array
ContentLengthBytes	content.length_bytes	long
ContentMIPMatchedLabel	content.mip_matched_label	string
ContentScanEngine	content.scan_engine	string
ContentSensitiveDataCategories	content.sensitive_data_categories	array
ContentSourceElementSelector	content.source_element_selector	string
ContentSourceURL	content.source_url	string
CortexDataLakeTenantID	customer_id	string
DeviceBrowserBrand	device.browser_brand	string
DeviceBrowserType	device.browser_type	string
DeviceBrowserVersion	device.browser_version	string
DeviceUUID	device.device_uuid	string
DeviceDiskEncryptionStatus	device.disk_encryption_status	string
DeviceEPPStatus	device.epp_status	string
DeviceExtensionVersion	device.extension_version	string
DeviceFirewallStatus	device.firewall_status	string
DeviceGeoIPFromCityName	device.geoip_from_city_name	string
DeviceGeoIPFromCountryName	device.geoip_from_country_name	string
DeviceGeoIPFromLocationLatitude	device.geoip_from_location_latitude	float
DeviceGeoIPFromLocationLongitude	device.geoip_from_location_longitude	float
DeviceGroupsIDs	device.groups.ids	array
DeviceGroupsNames	device.groups.names	array
DeviceHostname	device.hostname	string
DeviceIPAddress	device.ip_address	string
DeviceMACAddresses	device.mac_addresses	array
DeviceModel	device.model	string
DeviceOSAndroidBuild	device.os.android.build	string
DeviceOSAndroidPatch	device.os.android.patch	string
DeviceOSAndroidRelease	device.os.android.release	string
DeviceOSAndroidSDK	device.os.android.sdk	string
DeviceOSiOSMajor	device.os.ios.major	string
DeviceOSiOSMinor	device.os.ios.minor	string
DeviceOSiOSPatch	device.os.ios.patch	string
DeviceOSmacOSBugfix	device.os.macos.bugfix	string
DeviceOSmacOSBuild	device.os.macos.build	string
DeviceOSmacOSMajor	device.os.macos.major	string
DeviceOSmacOSMinor	device.os.macos.minor	string
DeviceOSmacOSServer	device.os.macos.server	boolean
DeviceOSType	device.os.type	string
DeviceOSWindowsBuild	device.os.windows.build	string
DeviceOSWindowsMajor	device.os.windows.major	string
DeviceOSWindowsMinor	device.os.windows.minor	string
DeviceOSWindowsPatch	device.os.windows.patch	string
DeviceOSWindowsProduct	device.os.windows.product	string
DeviceOSDisplayName	device.os_display_name	string
DeviceRawUniversalID	device.raw_universal_id	string
DeviceScreenLockStatus	device.screen_lock_status	string
DeviceSerialNumber	device.serial_number	string
DeviceType	device.type	string
DeviceUserAgent	device.user_agent	string
FileExtension	file.extension	string
FileIsEncrypted	file.is_encrypted	boolean
FileLocalPath	file.local_path	string
FileMimeType	file.mime_type	string
FileName	file.name	string
FileOperation	file.operation	string
FileOriginDownloadURL	file.origin_download_url	string
FileSHA256	file.sha256	string
FileURL	file.url	string
ID	id	string
LogSource	log_source	string
LogSourceGroupID	log_source_group_id	string
DeviceSN	log_source_id	string
DeviceName	log_source_name	string
TimeReceived	log_time	timestamp
LogType	log_type.value	string
NetworkClassifications	network.classifications	array
NetworkFrameURL	network.frame_url	string
NetworkHTTPMethod	network.http.method	string
NetworkHTTPStatus	network.http.status	int
NetworkProtocol	network.protocol	string
NetworkTabURL	network.tab_url	string
NetworkURL	network.url	string
PageCaptureIsSecureScreenshot	page.capture.is_secure_screenshot	boolean
PageCaptureTriggeredByURL	page.capture.triggered_by_url	string
PageDevtoolsBlockReason	page.devtools.block_reason	string
PageTitle	page.title	string
PincodeFailedAttempts	pincode.failed_attempts	long
PincodeRegistrationTime	pincode.registration_time	timestamp
PlatformType	platform_type	string
PolicyAction	policy.action	string
PolicyBlockReason	policy.block_reason	string
PolicyBypassReason	policy.bypass_reason	string
PolicyIsMonitor	policy.is_monitor	boolean
PolicyIsSessionRecorded	policy.is_session_recorded	boolean
PolicyRuleDescription	policy.rule_description	string
PolicyRuleID	policy.rule_id	string
PostureBlockReason	posture.block_reason	string
PostureBlockType	posture.block_type	string
PostureError	posture.error	string
PrintPrinterLocation	print.printer_location	string
PrintPrinterName	print.printer_name	string
ProcessCLIArgs	process.cli_args	string
ProcessImagePath	process.image_path	string
ProcessParentProcess	process.parent_process	string
ProcessPID	process.pid	long
StateDeviceGroupEvaluation	state.device_group_evaluation	array
StateSignInRules	state.sign_in_rules	array
SubtenantID	sub_tenant_id	string
Subtype	sub_type.value	string
TamperingType	tampering.type	string
TenantID	tenant_id	string
TimeGenerated	time_generated	timestamp
TimeGeneratedHighResolution	time_generated_high_res	timestamp
Timestamp	timestamp	timestamp
TSGID	tsg_id	string
Type	type	string
UserEmail	user.email	string
UserExternalID	user.external_id	string
UserGroupsIDs	user.groups.ids	array
UserGroupsNames	user.groups.names	array
UserID	user.id	string
UserName	user.name	string
UserTenantExternalID	user.tenant_external_id	string
UserTenantID	user.tenant_id	string
UserTenantName	user.tenant_name	string
UserTSGID	user.tsg_id	string
VendorName	vendor_name	string

Events EMAIL Fields

Events LEEF Fields

Strata Logging Service Docs

Events HTTPS Fields

Strata Logging Service Docs

Events HTTPS Fields

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner