DNS Security (Resolver and SDWAN and Panos 12.1 or later) LEEF Fields

Table of Contents

DNS Security (Resolver and SDWAN and Panos 12.1 or later) HTTPS Fields

DNS Security (Resolver and SDWAN and Panos 12.1 or later) LEEF Fields

The following table identifies the DNS Security (Resolver and SDWAN and Panos 12.1 or later) field names that the Log Forwarding app uses when you forward logs using the LEEF log format.

When you create a syslog forwarding profile , you can optionally create a profile token that the Log Forwarding app uses when it sends logs to the syslog server. If you configure a profile token, it appears in the log line immediately after the log type information (for example, TRAFFIC, THREAT, HIPMATCH, and so forth). The token will appear on a parameter called profileToken.

LEEF Name	Query Name	Field Type
Action	action.value	Custom
Application	app	Custom
ApplicationCategory	app_category	Custom
ApplicationSubcategory	app_sub_category	Custom
CloudHostname	cloud_hostname	Custom
ConfigVersion	config_version.value	Custom
ContainerID	container_id	Custom
ApplicationContainer	container_of_app	Custom
ContentVersion	content_version	Custom
RepeatCount	count_of_repeats	Custom
CortexDataLakeTenantId	customer_id	Custom
DestinationDeviceCategory	dest_device_category	Custom
DestinationDeviceClass	dest_device_class	Custom
DestinationDeviceHost	dest_device_host	Custom
DestinationDeviceMac	dest_device_mac	Custom
DestinationDeviceModel	dest_device_model	Custom
DestinationDeviceOS	dest_device_os	Custom
DestinationDeviceOSFamily	dest_device_osfamily	Custom
DestinationDeviceOSVersion	dest_device_osversion	Custom
DestinationDeviceProfile	dest_device_profile	Custom
DestinationDeviceVendor	dest_device_vendor	Custom
DestinationDynamicAddressGroup	dest_dynamic_address_group	Custom
DestinationEDL	dest_edl	Custom
DestinationIP	dest_ip.value	Custom
DestinationLocation	dest_location	Custom
dstPort	dest_port	Predefined
DestinationUserInfoDomain	dest_user_info.domain	Custom
DestinationUserInfoName	dest_user_info.name	Custom
DestinationUserInfoUUID	dest_user_info.uuid	Custom
DestinationUUID	dest_uuid	Custom
DGHierarchyLevel1	dg_hier_level_1	Custom
DGHierarchyLevel2	dg_hier_level_2	Custom
DGHierarchyLevel3	dg_hier_level_3	Custom
DGHierarchyLevel4	dg_hier_level_4	Custom
DirectionOfAttack	direction_of_attack.value	Custom
DNSRequestName	dns_request_name	Custom
DNSRdata	dns_response	Custom
DNSResponseCode	dns_response_code	Custom
DNSResponseFlags	dns_response_flags	Custom
DNSResponseTTL	dns_response_ttl	Custom
DNSResponseType	dns_response_type	Custom
DomainEDL	domain_edl	Custom
DestinationUser	dst_user	Custom
ToZone	dst_zone	Custom
DynamicUserGroupName	dynusergroup_name	Custom
EndpointSerialNumber	endpoint_serial_number	Custom
FlowSources	flow_type.value	Custom
url	fqdn	Predefined
FromZone	from_zone	Custom
ThreatID	gtid	Custom
HostID	host_id	Custom
HTTP2Connection	http2_connection	Custom
HTTPMethod	http_method.value	Custom
InboundInterface	inbound_if.value	Custom
InboundInterfaceDetailsPort	inbound_if_details.port	Custom
InboundInterfaceDetailsSlot	inbound_if_details.slot	Custom
InboundInterfaceDetailsType	inbound_if_details.type.value	Custom
InboundInterfaceDetailsUnit	inbound_if_details.unit	Custom
CaptivePortal	is_captive_portal	Custom
IsClienttoServer	is_client_to_server	Custom
IsContainer	is_container	Custom
IsDecryptMirror	is_decrypt_mirror	Custom
IsDecrypted	is_decrypted	Custom
IsDuplicateLog	is_dup_log	Custom
IsEncrypted	is_encrypted	Custom
LogExported	is_exported	Custom
LogForwarded	is_forwarded	Custom
IsIPV6	is_ipv6	Custom
IsMptcpOn	is_mptcp_on	Custom
NAT	is_nat	Custom
IsNonStandardDestinationPort	is_non_std_dest_port	Custom
IsPacketCapture	is_packet_capture	Custom
IsPhishing	is_phishing	Custom
IsPrismaNetwork	is_prisma_branch	Custom
IsPrismaUsers	is_prisma_mobile	Custom
IsProxy	is_proxy	Custom
IsReconExcluded	is_recon_excluded	Custom
IsSaaSApplication	is_saas_app	Custom
IsServertoClient	is_server_to_client	Custom
IsSourceXForwarded	is_source_x_fwded	Custom
IsSystemReturn	is_sym_return	Custom
IsTransaction	is_transaction	Custom
IsTunnelInspected	is_tunnel_inspected	Custom
IsURLDenied	is_url_denied	Custom
K8SClusterID	k8s_cluster_id	Custom
LocalDeepLearningAnalyzed	local_deep_learning	Custom
Location	location	Custom
LogSetting	log_set	Custom
LogSource	log_source	Custom
LogSourceGroupID	log_source_group_id	Custom
DeviceSN	log_source_id	Custom
DeviceName	log_source_name	Custom
LogSourceTimeZoneOffset	log_source_tz_offset	Custom
TimeReceived	log_time	Custom
cat	log_type.value	Predefined
IMEI	monitor_tag_imei	Custom
dstPostNAT	nat_dest.value	Predefined
dstPostNATPort	nat_dest_port	Predefined
srcPostNAT	nat_source.value	Predefined
srcPostNATPort	nat_source_port	Predefined
NonStandardDestinationPort	non_standard_dest_port	Custom
NSSAINetworkSliceType	nssai_network_slice_type.value	Custom
EgressInterface	outbound_if.value	Custom
OutboundInterfaceDetailsPort	outbound_if_details.port	Custom
OutboundInterfaceDetailsSlot	outbound_if_details.slot	Custom
OutboundInterfaceDetailsType	outbound_if_details.type.value	Custom
OutboundInterfaceDetailsUnit	outbound_if_details.unit	Custom
PanoramaSN	panorama_serial	Custom
ParentSessionID	parent_session_id	Custom
ParentStarttime	parent_start_time	Custom
PartialHash	partial_hash	Custom
PayloadProtocolID	payload_protocol_id	Custom
PlatformType	platform_type	Custom
ContainerName	pod_name	Custom
ContainerNameSpace	pod_namespace	Custom
proto	protocol.value	Predefined
DNSRequestType	record_type	Custom
ReportID	report_id	Custom
ApplicationRisk	risk_of_app	Custom
SecurityRule	rule_matched	Custom
RuleUUID	rule_matched_uuid	Custom
SanctionedStateOfApp	sanctioned_state_of_app	Custom
SequenceNo	sequence_no	Custom
SessionID	session_id	Custom
Severity	severity	Custom
SigFlags	sig_flags	Custom
SourceDeviceCategory	source_device_category	Custom
SourceDeviceClass	source_device_class	Custom
SourceDeviceHost	source_device_host	Custom
SourceDeviceMac	source_device_mac	Custom
SourceDeviceModel	source_device_model	Custom
SourceDeviceOS	source_device_os	Custom
SourceDeviceOSFamily	source_device_osfamily	Custom
SourceDeviceOSVersion	source_device_osversion	Custom
SourceDeviceProfile	source_device_profile	Custom
SourceDeviceVendor	source_device_vendor	Custom
SourceDynamicAddressGroup	source_dynamic_address_group	Custom
SourceEDL	source_edl	Custom
src	source_ip.value	Predefined
SourceLocation	source_location	Custom
srcPort	source_port	Predefined
UsrName	source_user	Custom
SourceUserInfoDomain	source_user_info.domain	Custom
SourceUserInfoName	source_user_info.name	Custom
SourceUserInfoUUID	source_user_info.uuid	Custom
SourceUUID	source_uuid	Custom
SubType	sub_type.value	Custom
ApplicationTechnology	technology_of_app	Custom
DNSCategory	threat_category.value	Custom
DNSThreatName	threat_name	Custom
devTime	time_generated	Predefined
TimeGeneratedHighResolution	time_generated_high_res	Custom
SessionDuration	total_time_elapsed	Custom
TSGID	tsg_id	Custom
Tunnel	tunnel.value	Custom
TunneledApplication	tunneled_app	Custom
IMSI	tunnelid_imsi	Custom
URLCategory	url_category.value	Custom
URLDomain	url_domain	Custom
URLCounter	url_idx	Custom
Users	users	Custom
Vendor	vendor_name	Header
VendorSeverity	vendor_severity.value	Custom
Verdict	verdict.value	Custom
VirtualLocation	vsys	Custom
VirtualSystemID	vsys_id	Custom
VirtualSystemName	vsys_name	Custom
X-Forwarded-ForIP	xff_ip.value	Custom

DNS Security (Resolver and SDWAN and Panos 12.1 or later) HTTPS Fields

Decryption

Strata Logging Service Docs

DNS Security (Resolver and SDWAN and Panos 12.1 or later) LEEF Fields

Strata Logging Service Docs

DNS Security (Resolver and SDWAN and Panos 12.1 or later) LEEF Fields

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner