Authentication HTTPS Fields

The following table identifies the Authentication field names that the Log Forwarding app uses when you forward logs using the HTTPS log format.
HTTPS Name
Query Name
AuthenticationDescription
AuthEvent
AuthFactorNo
AuthenticationPolicy
AuthenticationProtocol
AuthServerProfile
AuthenticatedUserDomain
AuthenticatedUserName
AuthenticatedUserUUID
ClientType
ClientTypeName
ConfigVersion
CountOfRepeats
CortexDataLakeTenantID
DGHierarchyLevel1
DGHierarchyLevel2
DGHierarchyLevel3
DGHierarchyLevel4
IsDuplicateLog
LogExported
LogForwarded
IsPrismaNetworks
IsPrismaUsers
Location
LogSetting
LogSource
DeviceSN
DeviceName
LogSourceTimeZoneOffset
TimeReceived
LogType
MFAAuthenticationID
MFAVendor
NormalizeUser
Object
RuleMatched
RuleMatchedUUID
SequenceNo
AuthCacheServiceRegion
SessionID
SourceDeviceCategory
SourceDeviceHost
SourceDeviceMac
SourceDeviceModel
SourceDeviceOSFamily
SourceDeviceOSVersion
SourceDeviceProfile
SourceDeviceVendor
SourceIP
Subtype
TimeGenerated
TimeGeneratedHighResolution
User
UserAgentString
VendorName
VirtualLocation
VirtualSystemID
VirtualSystemName

Recommended For You