System CEF Fields

Example System log in CEF:
Feb 28 08:30:27 xxx.xx.x.xx 1442 <14>1 2021-02-28T08:30:27.339Z stream-logfwd20-587718190-02280003-lvod-harness-mjdh logforwarder - panwlogs - CEF:0|Palo Alto Networks|LF|2.0|SYSTEM|wildfire-appliance|1|ProfileToken=xxxxx dtz=UTC rt=Feb 28 2021 08:30:26 deviceExternalId=xxxxxxxxxxxxx PanOSConfigVersion=0.0 PanOSAgentContentVersion= PanOSAgentDataCollectionStatus= PanOSAgentID= PanOSAgentIsolationStatus= PanOSAgentStatus= PanOSAgentTimeZoneOffset= PanOSAgentVersion= PanOSEndpointCPUArchitecture= PanOSEndpointDeviceDomain= PanOSEndpointDeviceName= PanOSEndpointIPaddress= PanOSEndpointOSType= PanOSEndpointOSVersion= PanOSEndpointUserDomain= PanOSEndpointUserName=xxxxx PanOSEndpointUserUUID= PanOSIsDuplicateLog=false PanOSIsPrismaNetwork=false PanOSIsPrismaUsers=false cat= PanOSLogExported=false PanOSLogForwarded=true PanOSLogSource=firewall PanOSLogSourceTimeZoneOffset= PanOSSeverity=Informational PanOSTenantID=xxxxxxxxxxxxx PanOSVDIEndpoint= PanOSVirtualSystemID=0 PanOSEventTime=Feb 28 2021 08:30:17 cs3= cs3Label=VirtualLocation act= fname= msg=gRPC connection to f0d7d88a-0391-4899-a2e4-0938c4309e17.fei.lcaas-qa.us.paloaltonetworks.com:443 is established,​ xxx.xx.x.xx:48558 -> xxx.xx.x.xx:443 time: 2021-02-28 00:30:17 externalId=xxxxxxxxxxxxx PanOSDGHierarchyLevel1=0 PanOSDGHierarchyLevel2=0 PanOSDGHierarchyLevel3=0 PanOSDGHierarchyLevel4=0 PanOSVirtualSystemName= dvchost=xxxxx PanOSDeviceGroup= PanOSTemplate= PanOSTimeGeneratedHighResolution=Feb 28 2021 08:30:17
The following table identifies the System field names that the Log Forwarding app uses when you forward logs using the CEF log format.
CEF Name
Field Details
PanOSAgentContentVersion
Header Type:
Custom
PanOSAgentDataCollectionStatus
Header Type:
Custom
PanOSAgentID
Query Name:
agent_id
Header Type:
Custom
PanOSAgentIsolationStatus
Header Type:
Custom
PanOSAgentStatus
Header Type:
Custom
PanOSAgentVersion
Query Name:
agent_version
Header Type:
Custom
PanOSConfigVersion
Header Type:
Custom
PanOSTenantID
Query Name:
customer_id
Header Type:
Custom
PanOSDeviceGroup
Header Type:
Custom
PanOSDGHierarchyLevel1
Query Name:
dg_hier_level_1
Header Type:
Custom
PanOSDGHierarchyLevel2
Query Name:
dg_hier_level_2
Header Type:
Custom
PanOSDGHierarchyLevel3
Query Name:
dg_hier_level_3
Header Type:
Custom
PanOSDGHierarchyLevel4
Query Name:
dg_hier_level_4
Header Type:
Custom
PanOSEndpointCPUArchitecture
Header Type:
Custom
PanOSEndpointDeviceDomain
Header Type:
Custom
PanOSEndpointDeviceName
Header Type:
Custom
PanOSEndpointIPaddress
Header Type:
Custom
PanOSVDIEndpoint
Query Name:
endpoint_is_vdi
Header Type:
Custom
PanOSEndpointOSType
Header Type:
Custom
PanOSEndpointOSVersion
Header Type:
Custom
PanOSAgentTimeZoneOffset
Query Name:
endpoint_tz_offset
Header Type:
Custom
PanOSEndpointUserDomain
Header Type:
Custom
PanOSEndpointUserName
Header Type:
Custom
PanOSEndpointUserUUID
Header Type:
Custom
fname
Query Name:
event_component
Header Type:
Predefined
Max Length:
1023
msg
Query Name:
event_description
Header Type:
Predefined
Max Length:
1023
act
Header Type:
Predefined
Max Length:
63
PanOSEventTime
Query Name:
event_time
Header Type:
Custom
PanOSIsDuplicateLog
Query Name:
is_dup_log
Header Type:
Custom
PanOSLogExported
Query Name:
is_exported
Header Type:
Custom
PanOSLogForwarded
Query Name:
is_forwarded
Header Type:
Custom
PanOSIsPrismaNetwork
Query Name:
is_prisma_branch
Header Type:
Custom
PanOSIsPrismaUsers
Query Name:
is_prisma_mobile
Header Type:
Custom
cat
Header Type:
Predefined
Max Length:
1023
PanOSLogSource
Query Name:
log_source
Header Type:
Custom
deviceExternalId
Query Name:
log_source_id
Header Type:
Predefined
Max Length:
255
dvchost
Query Name:
log_source_name
Header Type:
Predefined
Max Length:
100
PanOSLogSourceTimeZoneOffset
Header Type:
Custom
rt
Query Name:
log_time
Header Type:
Predefined
Device Event Class ID
Query Name:
log_type.​value
Header Type:
Custom
externalId
Query Name:
sequence_no
Header Type:
Predefined
Max Length:
40
PanOSSeverity
Query Name:
severity
Header Type:
Custom
Name
Query Name:
sub_type.​value
Header Type:
Custom
PanOSTemplate
Query Name:
template.​value
Header Type:
Custom
PanOSTimeGeneratedHighResolution
Header Type:
Custom
Device Vendor
Query Name:
vendor_name
Header Type:
Custom
PanOSVendorSeverity
Header Type:
Custom
cs3
Query Name:
vsys
Header Type:
Predefined
Label:
cs3Label
Label Text:
VirtualLocation
Max Length:
4000
PanOSVirtualSystemID
Query Name:
vsys_id
Header Type:
Custom
PanOSVirtualSystemName
Query Name:
vsys_name
Header Type:
Custom

Recommended For You