>
    Strata Copilot
    Application Security CEF Fields
    Focus
    Download PDF
    Focus
    1. Home
    2. Strata Logging Service
    3. Strata Logging Service Log Reference
    4. Network Logs
    5. Application Security
    6. Application Security CEF Fields
    Download PDF
    Strata Logging Service

    Application Security CEF Fields

    Table of Contents

    Application Security CEF Fields

    The following table identifies the Application Security field names that the Log Forwarding app uses when you forward logs using the CEF log format.
    CEF Name
    Field Details
    act
    Query Name: action.​value
    Header Type: Predefined
    app
    Query Name: app
    Header Type: Predefined
    PanOSCortexDataLakeTenantID
    Query Name: customer_id
    Header Type: Custom
    dst
    Query Name: dest_ip.​value
    Header Type: Predefined
    dpt
    Query Name: dest_port
    Header Type: Predefined
    PanOSFQDNApplicationName
    Query Name: fqdn_app_name
    Header Type: Custom
    PanOSInternalSourceAddress
    Query Name: internal_source_ip.​value
    Header Type: Custom
    PanOSLogSource
    Query Name: log_source
    Header Type: Custom
    LogSourceGroupID
    Query Name: log_source_group_id
    Header Type: Custom
    deviceExternalId
    Query Name: log_source_id
    Header Type: Predefined
    dvchost
    Query Name: log_source_name
    Header Type: Predefined
    PanOSLogSourceTimeZoneOffset
    Query Name: log_source_tz_offset
    Header Type: Custom
    rt
    Query Name: log_time
    Header Type: Predefined
    Device Event Class ID
    Query Name: log_type.​value
    Header Type: Custom
    PlatformType
    Query Name: platform_type
    Header Type: Custom
    PanOSApplicationSecurityPolicyRuleAdditionalDetails
    Query Name: policy_rule_additional_details
    Header Type: Custom
    PanOSApplicationSecurityPolicyRuleName
    Query Name: policy_rule_name
    Header Type: Custom
    PanOSApplicationSecurityPolicyRuleType
    Query Name: policy_rule_type.​value
    Header Type: Custom
    PanOSHTTPResponseCode
    Query Name: response_code
    Header Type: Custom
    cn1
    Query Name: session_id
    Header Type: Predefined
    src
    Query Name: source_ip.​value
    Header Type: Predefined
    spt
    Query Name: source_port
    Header Type: Predefined
    suser
    Query Name: source_user
    Header Type: Predefined
    Name
    Query Name: sub_type.​value
    Header Type: Custom
    start
    Query Name: time_generated
    Header Type: Predefined
    PanOSTimeGeneratedHighResolution
    Query Name: time_generated_high_res
    Header Type: Custom
    PanOSTraceID
    Query Name: trace_id
    Header Type: Custom
    PanOSTSGID
    Query Name: tsg_id
    Header Type: Custom
    PanOSURL
    Query Name: url
    Header Type: Custom
    Device Vendor
    Query Name: vendor_name
    Header Type: Custom

    © 2026 Palo Alto Networks, Inc. All rights reserved.