Application Security LEEF Fields

Table of Contents

Application Security LEEF Fields

The following table identifies the Application Security field names that the Log Forwarding app uses when you forward logs using the LEEF log format.

When you create a syslog forwarding profile , you can optionally create a profile token that the Log Forwarding app uses when it sends logs to the syslog server. If you configure a profile token, it appears in the log line immediately after the log type information (for example, TRAFFIC, THREAT, HIPMATCH, and so forth). The token will appear on a parameter called profileToken.

LEEF Name	Query Name	Field Type
Custom	action.value	Custom
Custom	app	Custom
Custom	customer_id	Custom
Predefined	dest_ip.value	Custom
Predefined	dest_port	Custom
Custom	fqdn_app_name	Custom
Custom	internal_source_ip.value	Custom
Custom	log_source	Custom
Custom	log_source_group_id	Custom
Custom	log_source_id	Custom
Custom	log_source_name	Custom
Custom	log_source_tz_offset	Custom
Custom	log_time	Custom
cat	log_type.value	Predefined
Custom	platform_type	Custom
Custom	policy_rule_additional_details	Custom
Custom	policy_rule_name	Custom
Custom	policy_rule_type.value	Custom
Custom	response_code	Custom
Custom	session_id	Custom
Predefined	source_ip.value	Custom
Predefined	source_port	Custom
Predefined	source_user	Custom
Custom	sub_type.value	Custom
Predefined	time_generated	Custom
Custom	time_generated_high_res	Custom
Custom	trace_id	Custom
Custom	tsg_id	Custom
Custom	url	Custom
Header	vendor_name	Custom

Application Security HTTPS Fields

Authentication

Strata Logging Service Docs

Application Security LEEF Fields

Strata Logging Service Docs

Application Security LEEF Fields

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner