>
    Strata Copilot
    SD-WAN Traffic EMAIL Fields
    Focus
    Download PDF
    Focus
    1. Home
    2. Strata Logging Service
    3. Strata Logging Service Log Reference
    4. SD-WAN Logs
    5. SD-WAN Traffic
    6. SD-WAN Traffic EMAIL Fields
    Download PDF
    Strata Logging Service

    SD-WAN Traffic EMAIL Fields

    Table of Contents

    SD-WAN Traffic EMAIL Fields

    The following table identifies the SD-WAN Traffic field names that the Log Forwarding app uses when you forward logs using the EMAIL log format.
    EMAIL Name
    Query Name
    Action
    action.​value
    Application
    app
    ApplicationCategory
    app_category
    ApplicationSubcategory
    app_sub_category
    BytesReceived
    bytes_received
    BytesSent
    bytes_sent
    ApplicationCharacteristics
    characteristics_of_app
    ApplicationContainer
    container_of_app
    CortexDataLakeTenantId
    customer_id
    DestinationIP
    dest_ip.​value
    DestinationPort
    dest_port
    DestinationUserInfoDomain
    dest_user_info.​domain
    DestinationUserInfoName
    dest_user_info.​name
    DestinationUserInfoUUID
    dest_user_info.​uuid
    FromZone
    from_zone
    InboundInterface
    inbound_if.​value
    IsClienttoServer
    is_client_to_server
    IsIPV6
    is_ipv6
    IsSaaSApplication
    is_saas_app
    LogSource
    log_source
    LogSourceGroupID
    log_source_group_id
    DeviceSN
    log_source_id
    DeviceName
    log_source_name
    LogSourceTimeZoneOffset
    log_source_tz_offset
    TimeReceived
    log_time
    LogType
    log_type.​value
    EgressInterface
    outbound_if.​value
    PacketsReceived
    packets_received
    PacketsSent
    packets_sent
    PathValue
    path.​value
    PathLabel
    path_label
    PlatformType
    platform_type
    SDWANElementId
    prisma_sdwan_element_id
    SDWANElementName
    prisma_sdwan_element_name
    SDWANSiteId
    prisma_sdwan_site_id
    SDWANSiteName
    prisma_sdwan_site_name
    SDWANTenantId
    prisma_sdwan_tenant_id
    IPProtocol
    protocol.​value
    ApplicationRisk
    risk_of_app
    SecurityRule
    rule_matched
    RuleUUID
    rule_matched_uuid
    SanctionedStateOfApp
    sanctioned_state_of_app
    SessionEndReason
    session_end_reason.​value
    SessionID
    session_id
    SessionStartTime
    session_start_time
    SourceDeviceCategory
    source_device_category
    SourceDeviceClass
    source_device_class
    SourceDeviceHost
    source_device_host
    SourceDeviceMac
    source_device_mac
    SourceDeviceModel
    source_device_model
    SourceDeviceOS
    source_device_os
    SourceDeviceOSFamily
    source_device_osfamily
    SourceDeviceOSVersion
    source_device_osversion
    SourceDeviceProfile
    source_device_profile
    SourceDeviceVendor
    source_device_vendor
    SourceIP
    source_ip.​value
    SourcePort
    source_port
    SourceUser
    source_user
    SourceUserInfoDomain
    source_user_info.​domain
    SourceUserInfoName
    source_user_info.​name
    SourceUserInfoUUID
    source_user_info.​uuid
    SubType
    sub_type.​value
    ApplicationTechnology
    technology_of_app
    TimeGenerated
    time_generated
    TimeGeneratedHighResolution
    time_generated_high_res
    ToZone
    to_zone
    SessionDuration
    total_time_elapsed
    TrafficClass
    traffic_class
    TSGID
    tsg_id
    URLCategory
    url_category.​value
    VendorName
    vendor_name

    © 2026 Palo Alto Networks, Inc. All rights reserved.